# changelog

author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-15.1
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161639)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162287)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161678)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-16
changelog:
  - add /var/lib/dovecot to tmpfiles for image mode (RHEL-139098)
  - fix building with latest openssl (RHEL-140619)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-5
changelog:
  - edk2-MdePkg-Acpi66.h-Add-ACPI-6.6-header.patch [RHEL-109010]
  - edk2-OvmfPkg-WorkArea.h-Add-MAILBOX_GDT.patch [RHEL-109010]
  - edk2-OvmfPkg-Add-the-Test-command-in-TDX-MailBox.patch [RHEL-109010]
  - edk2-OvmfPkg-Add-the-ResetVector-in-TDX-MailBox.patch [RHEL-109010]
  - edk2-OvmfPkg-TdxDxe-Support-5-level-paging-for-ResetVecto.patch [RHEL-109010]
  - edk2-OvmfPkg-IoMmuDxe-Fix-1M-and-2M-buffer-handling.patch [RHEL-69780]
  - Resolves: RHEL-109010
    (TD guest dmesg reports ACPI BIOS Warning (bug): Incorrect checksum in table [APIC] - 0x29)
  - Resolves: RHEL-69780
    (Fail to create AMD SEV SLES 15 SP4 guest via virt-install --cdrom [rhel-9.8])


author: Jon Maloy <jmaloy@redhat.com> - 20241117-6
changelog:
  - edk2-OvmfPkg-MemEncryptSevLib-Evict-cache-lines-during-SN.patch [RHEL-121983]
  - edk2-MdePkg-Add-the-COHERENCY_SFW_NO-CPUID-bit-field.patch [RHEL-121983]
  - edk2-OvmfPkg-ResetVector-Make-ReceivedVc-a-flag-in-SEV-ES.patch [RHEL-121983]
  - edk2-OvmfPkg-MemEncryptSevLib-Check-if-SEV-SNP-coherency-.patch [RHEL-121983]
  - Resolves: RHEL-121983
    ([edk2] VM panic on booting SNP guest with large memory on Genoa)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-7
changelog:
  - edk2-make-dbxupdate.sh-get-version-tag-add-to-commit-mess.patch [RHEL-126100]
  - edk2-update-dbx-to-20251016-v1.6.1.patch [RHEL-126100]
  - Resolves: RHEL-126100
    ([edk2,rhel-9] dbx update to 20251016 / v1.6.1)


author: Jon Maloy <jmaloy@redhat.com> - 20241117-8
changelog:
  - edk2-openssl-flatten-contents-of-openssl-tarball.patch [RHEL-115922]
  - edk2-Bumped-openssl-submodule-to-version-3.0.7-29.1.patch [RHEL-115922]
  - Resolves: RHEL-115922
    (CVE-2025-9230 edk2: Out-of-bounds read & write in RFC 3211 KEK Unwrap [rhel-9.8])


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142427, RHEL-142411, RHEL-142395, RHEL-142379, RHEL-142363
    Resolves: RHEL-142348, RHEL-142332


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148052, RHEL-148053, RHEL-148056, RHEL-148075, RHEL-148081
    Resolves: RHEL-148098, RHEL-148105, RHEL-148106, RHEL-148941, RHEL-149032
    Resolves: RHEL-149043, RHEL-149066, RHEL-155994


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.4
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148046, RHEL-148049, RHEL-148054, RHEL-148061, RHEL-148079
    Resolves: RHEL-148094, RHEL-148096, RHEL-148104, RHEL-148939, RHEL-149029
    Resolves: RHEL-149042, RHEL-149065, RHEL-155993


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.6
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-162958, RHEL-162978


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.7
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159815, RHEL-155477, RHEL-161046, RHEL-161481
    Resolves: RHEL-161517, RHEL-161084, RHEL-167803


author: Tony Camuso <tcamuso@redhat.com> - 25.04-1
changelog:
  - Update to latest upstream.
  - Clean up install paths, drop obsolete patches, and improve flag injection
  handling
  - Replaced hard-coded install paths in Makefiles with sed-based DESTDIR
    fixes for lib, pqos, rdtset, and membw
    - Using sed during %prep is more robust and version-agnostic than patching,
      which requires rebasing each release
  - Relocated admin tools (pqos*, rdtset) from /usr/bin to /usr/sbin for FHS
    compliance
    - These tools require root and interact with system-level cache controls
  - Updated %files to match SONAME bump (libpqos.so.5 -> libpqos.so.6) introduced
    upstream
  - Dropped patches 0001, 0002, 0004, 0005
    - 0001/0002 replaced by sed
  - Ensure CFLAGS and LDFLAGS are augmented, not overridden by using sed to
    convert assignments to +=
    - Ensures compatibility with distro-injected flags (e.g. -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection,
      hardening) without carrying a version-specific patch
    Resolves: RHEL-122380


author: Tony Camuso <tcamuso@redhat.com> - 25.04-1
changelog:
  - Update to latest upstream.
  - Clean up install paths, drop obsolete patches, and improve flag injection
  handling
  - Replaced hard-coded install paths in Makefiles with sed-based DESTDIR
    fixes for lib, pqos, rdtset, and membw
    - Using sed during %prep is more robust and version-agnostic than patching,
      which requires rebasing each release
  - Relocated admin tools (pqos*, rdtset) from /usr/bin to /usr/sbin for FHS
    compliance
    - These tools require root and interact with system-level cache controls
  - Updated %files to match SONAME bump (libpqos.so.5 -> libpqos.so.6) introduced
    upstream
  - Dropped patches 0001, 0002, 0004, 0005
    - 0001/0002 replaced by sed
  - Ensure CFLAGS and LDFLAGS are augmented, not overridden by using sed to
    convert assignments to +=
    - Ensures compatibility with distro-injected flags (e.g. -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection,
      hardening) without carrying a version-specific patch
    Resolves: RHEL-122380


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142687
  - Related: RHEL-139534
  - Related: RHEL-131588
  - Related: RHEL-131600
  - Related: RHEL-142875
  - Related: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-3
changelog:
  - Update tagging scripts to include signature checks and correctly handle gating
  - Add gating scripts to simplify obtaining results and waiving issues
  - Resolves: RHEL-147634
  - Resolves: RHEL-151197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-1
changelog:
  - Update to 8u492-b09 (GA)
  - Update release notes for 8u492-b09.
  - Add missing CVEs for 8u482.
  - Regenerate JDK-8199936/PR3533 patch following JDK-8374917
  - Regenerate JDK-8186464/RH1433262 patch following JDK-8370986
  - Drop local giflib 5.2.2 patch now JDK-8328999 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump LCMS 2 version to 2.15.0 following JDK-8303482
  - Bump libpng version to 1.6.57 following JDK-8375063, JDK-8377526, JDK-8380959 & JDK-8382047
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169446
  - Resolves: RHEL-133291
  - Resolves: RHEL-147348
  - Resolves: RHEL-148407
  - Resolves: RHEL-148981
  - Resolves: RHEL-161303
  - Resolves: RHEL-161452
  - Resolves: RHEL-157139
  - Resolves: RHEL-157156


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.18+7 (EA)
  - Add to .gitignore openjdk-17.0.18+7-ea.tar.xz
  - Set updatever to 18
  - Set buildver to 7
  - Set is_ga to 0
  - Update sources to openjdk-17.0.18+7-ea.tar.xz
  - Set bundled libpng version to 1.6.51
  - Resolves: RHEL-131590
  - Resolves: RHEL-131601
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-1
changelog:
  - Update to jdk-17.0.18+8 (GA)
  - Add to .gitignore openjdk-17.0.18+8.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set buildver to 8
  - Set is_ga to 1
  - Update sources to openjdk-17.0.18+8.tar.xz
  - Resolves: RHEL-139552
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set rpmrelease to 2
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
  - Set fipsver to e1780dd5d39
  - Resolves: RHEL-122136


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Add test to ensure blocked.certs is valid (OPENJDK-4362)
  - Restore NEWS file so portable can be rebuilt
  - Resolves: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set portablerelease to 2
  - Remove test to ensure blocked.certs is valid, done in portable
  - Related: RHEL-122136
  - Related: RHEL-131590
  - Related: RHEL-131601
  - Related: RHEL-139552
  - Related: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.19.0.10-1
changelog:
  - Update to jdk-17.0.19+10 (GA)
  - Add to .gitignore openjdk-17.0.19+10.tar.xz
  - Set updatever to 19
  - Set buildver to 10
  - Set rpmrelease to 1
  - Update sources to openjdk-17.0.19+10.tar.xz
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Set tzdata requires and build requires to 2026a
  - Set bundled freetype library version to 2.14.2
  - Set bundled giflib library version to 6.1.2
  - Set bundled harfbuzz library version to 12.3.2
  - Set bundled libpng library version to 1.6.57
  - Set bundled zlib library version to 1.3.2
  - Set fipsver to 62c0f885e30
  - Sync NEWS from openjdk-portable-rhel-8
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set portablerelease to 1
  - Resolves: RHEL-133292
  - Resolves: RHEL-147350
  - Resolves: RHEL-148408
  - Resolves: RHEL-148987
  - Resolves: RHEL-161296
  - Resolves: RHEL-161445
  - Resolves: RHEL-157135


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142859
  - Related: RHEL-139560
  - Related: RHEL-131592
  - Related: RHEL-131602
  - Related: RHEL-122121
  - Related: RHEL-142820


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.11.0.10-1
changelog:
  - Update to jdk-21.0.11+10 (GA)
  - Update release notes to 21.0.11+10
  - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169609
  - Resolves: RHEL-133293
  - Resolves: RHEL-147352
  - Resolves: RHEL-148409
  - Resolves: RHEL-148992
  - Resolves: RHEL-157141
  - Resolves: RHEL-161305
  - Resolves: RHEL-161454
  - Resolves: RHEL-169616


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-1
changelog:
  - Update to jdk-25.0.3+9 (GA)
  - Update release notes to 25.0.3+9
  - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
  - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
  - Drop local HarfBuzz patch now JDK-8375057 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169619
  - Resolves: RHEL-157142
  - Resolves: RHEL-157154
  - Resolves: RHEL-161306
  - Resolves: RHEL-161455
  - Resolves: RHEL-169615


author: Tomas Halman <thalman@redhat.com> - 1.6-19.0.2
changelog:
  - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
  - Resolves: RHEL-168184


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.46.1.el9_7]
changelog:
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154094]
  - net: mana: Reduce waiting time if HWC not responding (Maxim Levitsky) [RHEL-92243]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.47.1.el9_7]
changelog:
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.48.1.el9_7]
changelog:
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
  - iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
  - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.49.1.el9_7]
changelog:
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-683.el9]
changelog:
  - perf amd ibs: Sync arch/x86/include/asm/amd-ibs.h header with the kernel (Michael Petlan) [RHEL-106898]
  - perf test amd ibs: Add sample period unit test (Michael Petlan) [RHEL-106898]
  - perf mem/c2c amd: Add ldlat support (Michael Petlan) [RHEL-106898]
  - perf test: Simplify data symbol test (Michael Petlan) [RHEL-106898]
  - perf test: Add timeout to datasym workload (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Incorporate Zen5 DTLB and PageSize information (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Add Load Latency bits in raw dump (Michael Petlan) [RHEL-106898]
  - ice: dpll: fix rclk pin state get and misplaced header macros (Ivan Vecera) [RHEL-146370]
  - ice: dpll: Support E825-C SyncE and dynamic pin discovery (Ivan Vecera) [RHEL-146370]
  - drivers: Add support for DPLL reference count tracking (Ivan Vecera) [RHEL-146370]
  - redhat: configs: Enable CONFIG_DPLL_REFCNT_TRACKER for debug (Ivan Vecera) [RHEL-146370]
  - dpll: Add reference count tracking support (Ivan Vecera) [RHEL-146370]
  - dpll: Enhance and consolidate reference counting logic (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Add support for mux pin type (Ivan Vecera) [RHEL-146370]
  - dpll: Support dynamic pin index allocation (Ivan Vecera) [RHEL-146370]
  - dpll: Add notifier chain for dpll events (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Associate pin with fwnode handle (Ivan Vecera) [RHEL-146370]
  - dpll: Allow associating dpll pin with a firmware node (Ivan Vecera) [RHEL-146370]
  - perf/x86/amd/uncore: Avoid a false positive warning about snprintf truncation in amd_uncore_umc_ctx_init (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Prevent UMC counters from saturating (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Add parameter to configure hrtimer (Michael Petlan) [RHEL-106948]
  - perf/x86/intel/uncore: Use HRTIMER_MODE_HARD for detecting overflows (Michael Petlan) [RHEL-106948]
  - perf/x86: Switch to use hrtimer_setup() (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Use hrtimer for handling overflows (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Michael Petlan) [RHEL-106948]
  - pinctrl: intel: fix build warnings about export.h (David Arcari) [RHEL-130326]
  - pinctrl: intel: drop repeated config dependency (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Import PWM_LPSS namespace for devm_pwm_lpss_probe() (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: Use dedicated helpers for chained IRQ handlers (David Arcari) [RHEL-130326]
  - pinctrl: elkhartlake: Add support for DSW community (David Arcari) [RHEL-130326]
  - pinctrl: intel: Add a human readable decoder for pull bias values (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: Add Panther Lake to the list of supported (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: use semicolon instead of comma in ncommunities assignment (David Arcari) [RHEL-130326]
  - pinctrl: amd: Clear GPIO debounce for suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Constify pointers to 'pinctrl_desc' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix hibernation support with CONFIG_SUSPEND unset (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix use of undeclared identifier 'pinctrl_amd_s2idle_dev_ops' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Add an LPS0 check() callback (David Arcari) [RHEL-130338]
  - pinctrl: Use str_enable_disable-like helpers [partial] (David Arcari) [RHEL-130338]
  - pinctrl: amd: Take suspend type into consideration which pins are non-wake (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix two small typos (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Convert to platform remove callback returning void (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask wake bits on probe again (David Arcari) [RHEL-130338]
  - idpf: Fix data race in idpf_net_dim (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: read lower clock bits inside the time sandwich (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: ixgbe: migrate to new RXFH callbacks (Michal Schmidt) [RHEL-139535]
  - idpf: Fix error handling in idpf_vport_open() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL ptr issue after soft reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT configuration on down interfaces (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix issue with ethtool -n command display (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak of flow steer list on rmmod (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: detach and close netdevs while handling a reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use desc_ring when checking completion queue DMA allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: convert vport state to bitmap (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vc_core_deinit() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix LAN memory regions command on some NVMs (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix irdma_alloc_ucontext_resp padding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix SRQ shadow area address initialization (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove doorbell elision logic (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add missing mutex destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SIGBUS in AEQ destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove unused CQ registry (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Take a lock before moving SRQ tail in poll_cq (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: depend on DEBUG_FS when building LIBIE_FWLOG (Michal Schmidt) [RHEL-122275 RHEL-139535]
  - RDMA/irdma: CQ size and shadow update changes for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix vf_id size to u16 to avoid overflow (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add Atomic Operations support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add SRQ support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Support 64-byte CQEs and GEN3 CQE opcode decoding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add support for V2 HMC resource management scheme (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend QP context programming for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 virtual QP1 support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Introduce GEN3 vPort driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 HW statistics support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 support for AEQ and CEQ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 CQP support with deferred completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Discover and set up GEN3 hardware register layout (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 core driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Refactor GEN2 auxiliary driver (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fwlog support for e610 (Michal Schmidt) [RHEL-139535]
  - i40e: fix Jumbo Frame support after iPXE boot (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie_aq_str (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie adminq descriptors (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ixgbe: use libie adminq descriptors (Michal Schmidt) [RHEL-139535]
  - idpf: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement get LAN MMIO memory regions (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - resource: Add resource set range and size helpers (Michal Schmidt) [RHEL-139535]
  - i40e: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ice, irdma: fix an off by one in error handling code (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ice: use napi's irq affinity and rmap IRQ notifiers (Michal Schmidt) [RHEL-139535]
  - net: intel: implement modern PM ops declarations [e100,e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - net: adopt skb_network_offset() and similar helpers [i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix aux device unplugging when rdma is not supported by vport (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: cap maximum Rx buffer size (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix error handling in the init_task on load (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vport_rel() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: keep the netdev when a reset fails (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: fix OOB in e1000_tbi_should_accept() (Michal Schmidt) [RHEL-139535] {CVE-2025-71093}
  - idpf: reduce mbx_task schedule delay to 300us (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [RHEL-139535 RHEL-97658] {CVE-2025-71133}
  - i40e: validate ring_len parameter against hardware-specific values (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: fix scheduling in set_rx_mode (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: correct queue index in Rx allocation error messages (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ixgbe: avoid redundant call to ixgbe_non_sfp_link_config() (Michal Schmidt) [RHEL-139535]
  - e1000e: Remove unneeded checks (Michal Schmidt) [RHEL-139535]
  - ixgbevf: ixgbevf_q_vector clean up (Michal Schmidt) [RHEL-139535]
  - fm10k: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ixgbevf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ice: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - iavf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - i40e: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_free_pble (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: delete a stray tab (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix possible vport_config NULL pointer deref in remove (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-68213}
  - net: ixgbe: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-139535]
  - RDMA/irdma: Remove redundant NULL check of udata in irdma_create_user_ah() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: support generic devlink param "max_mac_per_vf" (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for IDPF PCI programming interface (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Silently consume unsignaled completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Initialize cqp_cmds_info to prevent resource leaks (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Enforce local fence for LOCAL_INV WRs (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fix typos in ixgbe driver comments (Michal Schmidt) [RHEL-139535]
  - idpf: remove duplicate defines in IDPF_CAP_RSS (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: avoid redundant VF link state updates (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SD index calculation (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: cleanup remaining SKBs in PTP flows (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-40175}
  - idpf: fix mismatched free function for dma_alloc_coherent (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Remove unused struct irdma_cq fields (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - net: intel: fm10k: Fix parameter idx set but not used (Michal Schmidt) [RHEL-139535]
  - idpf: add HW timestamping statistics (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: improve VF MAC filters accounting (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Update Kconfig (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: fix linking with libie_{adminq,fwlog} when CONFIG_LIBIE=n (Michal Schmidt) [RHEL-139535]
  - i40e: remove redundant memory barrier when cleaning Tx descs (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for nointerrupt queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove SW marker handling from NAPI (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add 4-byte completion descriptor definition (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: link NAPIs to queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use a saner limit for default number of queues to allocate (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix Rx descriptor ready check barrier in splitq (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: drop unnecessary constant casts to u16 (Michal Schmidt) [RHEL-139535]
  - i40e: Fix potential invalid access when MAC list is empty (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39853}
  - i40e: remove read access to debugfs files (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39901}
  - idpf: fix UAF in RDMA core aux dev deinitialization (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: do not linearize big TSO packets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove obsolete stashing code (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: stop Tx if there are insufficient buffer resources (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: replace flow scheduling buffer ring with buffer pool (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: simplify and fix splitq Tx packet rollback error path (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: improve when to set RE bit logic (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add support for Tx refillqs in flow scheduling mode (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: intel: use vmalloc_array() to simplify code [fm10k] (Michal Schmidt) [RHEL-139535]
  - idpf: preserve coalescing settings across resets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add cross timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: rename enum virtchnl2_cap_rss (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ethernet: intel: fix building with large NR_CPUS [fm10k,i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: implement IDC vport aux driver MTU change handler (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement remaining IDC RDMA core callbacks and handlers (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement RDMA vport auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: implement core RDMA auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: use reserved RDMA vectors from control plane (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: return 0 size for RSS key if not supported (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-38402}
  - e1000: Move cancel_work_sync to avoid deadlock (Michal Schmidt) [RHEL-139535] {CVE-2025-38114}
  - i40e: retry VFLR handling if there is ongoing VF reset (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: return false from i40e_reset_vf if reset is in progress (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - iavf: convert to NAPI IRQ affinity API (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - ice: add ice driver PTP pin documentation (Michal Schmidt) [RHEL-139535]
  - i40e: add link_down_events statistic (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for Rx timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp flows (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp capabilities negotiation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add PTP clock configuration (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add mailbox access to read PTP clock time (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: negotiate PTP capabilities and get PTP clock (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: move virtchnl structures to the header file (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl: add PTP virtchnl definitions (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add initial PTP support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: change the method for mailbox workqueue allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove unreachable code from setting mailbox (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: assign extracted ptype to struct libeth_rqe_info field (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA: Don't use %pK through printk (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: use napi's irq affinity (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - intel/fm10k: Remove unused fm10k_iov_msg_mac_vlan_pf (Michal Schmidt) [RHEL-139535]
  - e1000: Hold RTNL when e1000_down can be called (Michal Schmidt) [RHEL-139535]
  - e1000: Link NAPI instances to queues and IRQs (Michal Schmidt) [RHEL-139535]
  - net: handle HAS_IOPORT dependencies [intel] (Michal Schmidt) [RHEL-139535]
  - intel: make module parameters readable in sys filesystem [e100] (Michal Schmidt) [RHEL-139535]
  - intel: add bit macro includes where needed [e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - ice: add documentation for FW logging (Michal Schmidt) [RHEL-139535]
  - i40e: Annotate struct i40e_qvlist_info with __counted_by (Michal Schmidt) [RHEL-139535]
  - fm10k: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e1000: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e100: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - net: e1000: Remove unused declarations (Michal Schmidt) [RHEL-139535]
  - Documentation/eth/intel: Remove references to SourceForge (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - Documentation/eth/intel: Update address for driver support (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - ixgb: Remove ixgb driver (Michal Schmidt) [RHEL-139535]
  - ice: Fix broken link in ice NAPI doc (Michal Schmidt) [RHEL-139535]
  - e100: Fix possible use after free in e100_xmit_prepare (Michal Schmidt) [RHEL-139535] {CVE-2022-49026}
  - fm10k: Fix error handling in fm10k_init_module() (Michal Schmidt) [RHEL-139535]
  - e1000: Remove unnecessary use of kmap_atomic() (Michal Schmidt) [RHEL-139535]
  - intel/fm10k:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - intel/e1000:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - fm10k: remove unexpected word "the" (Michal Schmidt) [RHEL-139535]
  - intel: remove unused macros [e100,e1000,ixgb] (Michal Schmidt) [RHEL-139535]
  - ixgb: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - e1000: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - i40e: remove enum i40e_client_state (Michal Schmidt) [RHEL-139535]
  - ixgb: Remove useless DMA-32 fallback configuration (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_build_skb() (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_consume_skb() (Michal Schmidt) [RHEL-139535]
  - fm10k: Fix syntax errors in comments (Michal Schmidt) [RHEL-139535]
  - e100: fix device suspend/resume (Michal Schmidt) [RHEL-139535]
  - ethernet: ixgb: use eth_hw_addr_set() (Michal Schmidt) [RHEL-139535]
  - ethernet: constify references to netdev->dev_addr in drivers [ixgb] (Michal Schmidt) [RHEL-139535]
  - ethernet: use eth_hw_addr_set() for dev->addr_len cases [intel] (Michal Schmidt) [RHEL-139535]
  - e100: fix buffer overrun in e100_get_regs (Michal Schmidt) [RHEL-139535]
  - e100: fix length calculation in e100_get_regs_len (Michal Schmidt) [RHEL-139535]
  - Doc: networking: Fox a typo in ice.rst (Michal Schmidt) [RHEL-139535]
  - e100: Avoid memcpy() over-reading of ETH_SS_STATS (Michal Schmidt) [RHEL-139535]
  - wifi: ath12k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - wifi: ath11k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - ALSA: update RHEL kconfigs for 6.18 upstream code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: properly initialize speaker_id for TAS2563 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6adm: the the copp device only during last instance (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6asm-dai: perform correct state check before closing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-tx-macro: fix SM6115 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: fix regmap leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: remove the reset operation in probe and remove (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for Lenovo platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for HP 200 G2i (Jaroslav Kysela) [RHEL-118911]
  - ALSA: realtek/alc288 fix headphone for MS Surface 2/3 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add Asus quirk for TAS amplifiers (Jaroslav Kysela) [RHEL-118911]
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40317}
  - ASoC: ops: fix snd_soc_get_volsw for sx controls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: support Q7.8 volume format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Always return 0 when a subsystem ID is found (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Convert FLOAT to S32 during blob selection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Prefer 32-bit DMIC blobs for 8-bit formats as well (Jaroslav Kysela) [RHEL-118911]
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Remove duplicated module macros (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Fix integer overflow in sample size validation (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68344}
  - ALSA: wavefront: Clear substream pointers on close (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68345}
  - ALSA: hda/tas2781: fix speaker id retrieval for multiple probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add match for ASUS Xbox Ally projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68346}
  - ASoC: amd: acp: update tdm channels for specific DAI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68753}
  - ALSA: uapi: Fix typo in asound.h comment (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68347}
  - ASoC: ak5558: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Audio is not resuming after s0ix (Jaroslav Kysela) [RHEL-118911]
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: catpt: Fix error path in hw_params() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_xcvr: clear the channel status control memory (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: add missing build config (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: nau8325: Silence uninitialized variables warnings (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: correct the wrong period (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong chip ID for reset variable check (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Fix missing dash in HIDE DisCo property (Jaroslav Kysela) [RHEL-118911]
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for HP ZBook X G2i platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED and Tas2781 for HP platform (Jaroslav Kysela) [RHEL-118911]
  - platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: au88x0: Fix incorrect error handling for PCI config reads (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Correct the wrong project ID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40275}
  - ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68281}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40269}
  - ALSA: hda/tas2781: Add new quirk for HP new projects (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: fix getting the wrong device number (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: va-macro: fix resource leak in probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2783A: Fix issues in firmware parsing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs4271: Fix regulator leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68205}
  - ASoC: da7213: Use component driver suspend/resume (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: cs35l56: Update firmware filename description for B0 silicon (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Enable mic on Vaio RPL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Fix sync error in consumer mode (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Fix build for sdw_utils (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: fix prepare clock stop failed (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_micfil: correct the endian format for DSD (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: fix bit order for DSD format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Use snd_codec format when initializing probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40344}
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add name_prefix for rt1321 part id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 (Jaroslav Kysela) [RHEL-118911]
  - ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix control pipe direction (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix vendor quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40162}
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add rt1321 part id to codec_info_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Generalize helper to clear IRQ status (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: Add support for QCS615 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,sm8250: Add QCS615 sound card (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Set tas2781_hda::tasdevice_priv::chip_id as TAS5825 in case of tas5825 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for Huawei Technologies Co., Ltd. CM-Q3 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Add MSI X870E Tomahawk to denylist (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40097}
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40098}
  - ASoC: rt722: add settings for rt722VB (Jaroslav Kysela) [RHEL-118911]
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Enable init_profile_id for device initialization (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Fix typo in docs (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: do not report invalid delay values (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Remove IRQ masking in suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Move IRQ enable/disable to encompass force suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: arizona: Make legacy gpiolib interface optional (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Add pin fix for HP ProDesk model (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add the initial mix for Presonus Studio 1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: doc: improved docs about quirk_flags in snd-usb-audio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: make param quirk_flags change-able in runtime (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: improve module param quirk_flags (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jaroslav Kysela) [RHEL-118911] {CVE-2025-39997}
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: document 'chan_map' member in snd_dec_opus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Set fw_regs table after getting REVID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix an error code in probe() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: stm32: sai: manage context in set_sysclk callback (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: fix signedness bug in wcd_dt_parse_micbias_info() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert MediaTek mt8183-mt6358 to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Convert MT8183 DA7219 sound card to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert mt8183-afe-pcm to dt-schema (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix spelling mistake "Perifpheral" -> "Peripheral" (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Remove unneeded semicolon (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't apply interface quirk to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - tas2783A: Add acpi match changes for Intel MTL (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: add machine driver changes (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: machine driver amp utility for TI devices (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Add soundwire based codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ops: improve snd_soc_get_volsw (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong description and register address on tas2781 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40132}
  - ASoC: qcom: qdsp6/audioreach: add support for offloading raw opus playback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: increase SNDRV_COMPRESS_VERSION minor version by 1 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: add raw opus codec define and opus decoder structs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Drop struct qmc_dai_chan (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Only request completion on last channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Ensure audio channels are ordered in TDM bus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: da7213: Convert to DEFINE_RUNTIME_DEV_PM_OPS() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move status_update callback to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move component ops to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move WCD_SDW_CH to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd: add common helper for wcd codecs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: make stub functions inline (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: set the comp soundwire port correctly (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40045}
  - ASoC: soc-dapm: add snd_soc_dapm_set_idle_bias() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step2 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step1 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: remove suspend_bias_off from snd_soc_dapm_context (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-card: add snd_soc_card_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: add snd_soc_component_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: use dapm->component instead of container_of() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_card() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_dev() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: spi/at73c213: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: add bindings for pm4125 audio codec (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40142}
  - ASoC: Intel: hda-sdw-bpt: set persistent_buffer false (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-generic: remove shared static buffer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: asihpi: Simplify error handling in PCM substream setup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: apple: mca: Add "apple,t8103-mca" compatible (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Remove redundant size arguments from strscpy() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: pcm1754: add pcm1754 dac driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,pcm1754: add binding documentation (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/dbri: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/cs4231: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/amd7930: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fcp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: fix scoped_guard done variable misuse (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ppc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd_ps3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: parisc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd-n64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sgio2audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: arm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Don't split string across lines (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add test for getting cal data from HP EFI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add HP-specific EFI variable for calibration data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add tests for cs_amp_get_vendor_spkid() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Check for vendor-specific speaker ID value (Jaroslav Kysela) [RHEL-118911]
  - efi: Add EFI_ACCESS_DENIED status code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add handling for Lenovo and HP UEFI speaker ID (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Rename defines for Cirrus Logic EFI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hrtimer: Avoid direct access to hrtimer clockbase (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40121}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Add default value for burst_bclkdiv (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Remove unused struct tlv320dac33_platform_data and header file tlv320dac33-plat.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_AVAIL64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_TSTAMP64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add 64-bit safe timestamp infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: scarlett2: Add Vocaster speaker/headphone mute controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Send the PCM period elapsed notification properly (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply "mixer_min_mute" quirks on some devices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add quirk QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: rename QUIRK_FLAG_MIXER_MIN_MUTE to QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Shutdown jack detection on suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Disable IRQs in system suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Store IRQ domain in codec private data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Rename system suspend callback and fix debug print (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: wlf,wm8960: Document routing strings (pin names) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-wsa-macro: add Codev version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-macro: add Codec version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: add compatible for glymur SoC (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: set card driver name from match data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: ssm4567: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5682: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5663: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5514: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt298: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt286: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt274: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: probe: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: nau8825: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98927: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98373: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98357a: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: i2stest: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: es8336: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: dmic: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: da7219: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: hda: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/conexant: Fix typos in comments (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Fix serialization in snd_rme32_capture_adat_open() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Fix a less than zero check on a u32 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use is_s4_resume() macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: topology: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix potential null pointer dereference (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40013}
  - soundwire: Use min() to improve code (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: Drop dev_pm_domain_detach() call (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_kcontrol_component() to snd_soc_kcontrol_to_component() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename dapm_kcontrol_get_value() to snd_soc_dapm_kcontrol_get_value() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_dapm() to snd_soc_dapm_kcontrol_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_widget() to snd_soc_dapm_kcontrol_to_widget() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: misc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: virtio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97bus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atmel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pxa2xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aaci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vxpocket: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pdaudiocf: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: at73c213: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: xen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for preset locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: caiaq: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bcd2000: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: qcom: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usx2y: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-u16550: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: portman2x4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mts64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mtpav: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mpu401: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dummy: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sscape: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu8000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opti9xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3sa2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: msnd: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es18xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1688: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmi8330: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1816a: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ymfpci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx222: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: via82xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sonicvibes: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme9652: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdspm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdsp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme96: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcxhr: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mixart: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: maestro3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx6464es: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: intel8x0: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: fm801: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1938: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for emu1010 FPGA locking (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs5535audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ca0106: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bt87x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1889: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als4000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als300: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: azt3328: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ali5451: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: isight: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sof: ipc4-topology: Add support to sched_domain attribute (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Introduce sof_client_dev_entry structure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Convert sof_client_dev_to_sof_dev into function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes: Add available points_info(), IPC4 only (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Human readable debugfs "probe_points" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Add sof_client_ipc4_find_swidget_by_id() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: IPC4: Add GET macros for module id and module instance id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Implement ipc4_probes_points_info (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for float sample type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for 8-bit formats (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: Add fixup for channels (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/rw: Cleanup with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/synth: Clean up with guard and auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/midi: Cleanup with guard and auto-cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss: Clean up core code with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up fifo locking with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up queue locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up port locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use auto-cleanup for client refcounting (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use guard() for mutex and rwsem locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up spin lock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Simplify internal command operation from OSS layer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ext: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/analog: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/component: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs8409: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs35l41: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use guard() for mutex locks and COEF locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use auto cleanup macros for DSP loader locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Introduce auto cleanup macros for PM (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: Internally link to Writing an ALSA Driver docs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: only detect codecs when HDA DSP probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: split codec mask detect and programming UNSOL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Remove (explicitly) unused header (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: adau1977: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Simplify dmi_match_quirk() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx_core: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: oss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fixes for handshake, MIDI out and cleanup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic32x4: use dev_err_probe() for regulators (Jaroslav Kysela) [RHEL-118911]
  - ASoC: imx-hdmi: remove cpu_pdev related code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: omap-twl4030: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,twl4030-audio: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: test-component: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for SMECNS module (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: sort modules based on hex ids (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix typos in I2S_INTF_TYPE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for static calibration (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add documentation for i2s interface type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: deprecate AR_TKN_U32_MODULE_[IN/OUT]_PORTS (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Use le16_to_cpu() for product ID comparison (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,wsa8830: Add reset-gpios for shared line (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Do not share the name pointer between components (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40338}
  - ASoC: Intel: avs: Drop pcm.h dependency for probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add infrastructure for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add deep sleep command (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio capture and decoding (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio playback and feedback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add PCM core infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add initial driver for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wl1273: Remove (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt1321: Add RT1321 amplifier support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in print_device_list() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use min() to simplify snd_hda_get_devices() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sst: Remove redundant semicolons (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in snd_hda_get_num_devices() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use auto-cleanup for shutdown locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Convert brcm,bcm2835-i2s to DT schema (Jaroslav Kysela) [RHEL-118911]
  - soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: realtek,alc5623: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fix "dependant"->"dependent" (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Replace manual mutex/spinlock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: 6fire: Clean ups with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: scarlett2: Clean ups with guard() and __free() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Add TAS5825 support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix spelling mistake "dismatch" -> "mismatch" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs48l32: Use PTR_ERR_OR_ZERO() to simplify code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: add some vendor registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: imx: Remove error print for devm_add_action_or_reset() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add keyword "init" in profile section (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dmaengine_pcm: Add port_window_size to DAI dma data struct (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Drop imx-audio-sgtl5000.txt (Jaroslav Kysela) [RHEL-118911]
  - ASoC: pxa: add GPIOLIB_LEGACY dependency (Jaroslav Kysela) [RHEL-118911]
  - ASoC: add GPIOLIB_LEGACY dependency where needed (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_init_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_force_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_init_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_get_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Conditional-path support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Parse conditional path tuples (Jaroslav Kysela) [RHEL-118911]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-684.el9]
changelog:
  - new config in drivers/phy (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Izabela Bakollari) [RHEL-121401]
  - r8169: make Kconfig option for LED support user-visible (Izabela Bakollari) [RHEL-121401]
  - net: phy: use new iterator mdiobus_for_each_phy in mdiobus_prevent_c45_scan (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: simplify return in ksz9477_phy_errata() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: remove old sfp_parse_* functions (Izabela Bakollari) [RHEL-121401]
  - net: sfp: convert sfp quirks to modify struct sfp_module_support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: pre-parse the module support (Izabela Bakollari) [RHEL-121401]
  - of: mdio: warn if deprecated fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: fix duplex setting error for phy leds (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix clk warning when removing the driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: enable serdes option mode for RTL8226-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix RTL8211F wake-on-lan support (Izabela Bakollari) [RHEL-121401]
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Izabela Bakollari) [RHEL-121401]
  - phy: micrel: add Signal Quality Indicator (SQI) support for KSZ9477 switch PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: assign default match function for non-PHY MDIO devices (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add cable test support for KSZ9477-class PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add RX error counter support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add MDI/MDI-X control support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: remove KSZ9477 EEE quirks now handled by phylink (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume (Izabela Bakollari) [RHEL-121401]
  - net: phy: drop phy_settings and the associated lookup helpers (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Dynamically control external clock of KSZ PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: c45: improve handling of disabled EEE modes in generic ethtool functions (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: remove call to devm_hwmon_sanitize_name (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: make HWMON support a user-visible Kconfig symbol (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add hwmon support for temp sensor on RTL822x (Izabela Bakollari) [RHEL-121401]
  - net: sfp: return the number of written bytes for smbus single byte access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: Add power management and soft reset support (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Izabela Bakollari) [RHEL-121401]
  - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Izabela Bakollari) [RHEL-121401]
  - net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add SQI support for LAN867x Rev.D0 PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add SQI and SQI+ support for OATC14 10Base-T1S PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: implement configurability for SGMII in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: add hwtstamp_get callback to phy drivers (Izabela Bakollari) [RHEL-121401]
  - phy: rename hwtstamp callback to hwtstamp_set (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86252 and MxL86282 (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86211C (Izabela Bakollari) [RHEL-121401]
  - net: mdio: eliminate kdoc warnings in mdio_device.c and mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Izabela Bakollari) [RHEL-121401]
  - net: ethtool: Add support for 1600Gbps speed (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Simplify register value passing (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Fix software power-down ready condition (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_phy_eee() helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr1 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate has_phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_rgmii_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add missing supported link modes for the fixed-link (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814: Enable in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove setting supported/advertised modes from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Handle devm_phy_package_join() failure in vsc85xx_probe_common() (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Add support for PHY LED control (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Consolidate probe functions into a common helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Simplify LED mode update using phy_modify() (Izabela Bakollari) [RHEL-121401]
  - net: mdio: fix resource leak in mdiobus_register_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814 fix reset of the QSGMII interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s:: add cable diagnostic support for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add OATC14 10BASE-T1S PHY cable diagnostic support (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_device members pause and asym_pause bitfield bits (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce internal API for PHY MSE diagnostics (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add interrupt support for RTL8221B (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: configure link status control for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add support for Microchip LAN867X Rev.D0 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: add iterator mdiobus_for_each_phy (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83869: fix STRAP_OPMODE bitmask (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8531 (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Add RTL8224 cable testing support (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: Disable EEE support as not implemented (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed wake-on-lan PHY speed control (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed MAC Wake-on-Lan support (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_may_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_can_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: always set shared->phydev for LAN8814 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix typos in comments (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix rtl8221b-vm-cg name (Izabela Bakollari) [RHEL-121401]
  - net: mdio: use macro module_driver to avoid boilerplate code (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: Fix GMII/MII/MII-Lite selection (Izabela Bakollari) [RHEL-121401]
  - net: doc: Fix typos in docs (Izabela Bakollari) [RHEL-121401]
  - net: sfp: don't include swphy.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: annotate linkmode initializers as not used after init phase (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_unregister (Izabela Bakollari) [RHEL-121401]
  - docs: networking: phy: clarify abbreviation "PAL" (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix lan8814_config_init (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix default LED behaviour (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: improve phydev and driver removal handling (Izabela Bakollari) [RHEL-121401]
  - net: phy: ax88796b: Replace hard-coded values with PHY_ID_MATCH_MODEL() (Izabela Bakollari) [RHEL-121401]
  - net: phy: update all PHYs to use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: provide sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_copy() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: use %pe in print format (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add Fast link failure support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear link parameters on admin link down (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: use bitmap_empty() where appropriate (Izabela Bakollari) [RHEL-121401]
  - net: phylink: warn if deprecated array-style fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: Convert to phy_id_compare_model() (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_model() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Update Kconfig help text (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove two function stubs (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: delete aqr_firmware_read_fingerprint() prototype (Izabela Bakollari) [RHEL-121401]
  - net: phy: NXP_TJA11XX: Update Kconfig with TJA1102 support (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: create and store a 64-bit firmware image fingerprint (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: report and configure in-band autoneg capabilities (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: print global syscfg registers (Izabela Bakollari) [RHEL-121401]
  - net: phy: transfer phy_config_inband() locking responsibility to phylink (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add PTP support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce function __lan8814_ptp_probe_once (Izabela Bakollari) [RHEL-121401]
  - net: phylink: disable autoneg for interfaces that have no inband (Izabela Bakollari) [RHEL-121401]
  - net: phylink: provide phylink_get_inband_type() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_weight() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for FLYPRO copper SFP+ module (Izabela Bakollari) [RHEL-121401]
  - net: phy: mtk-2p5ge: Add LED support for MT7988 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: simplify fixed_mdio_read (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: support for TRIGGER_NETDEV_LINK on RTL8211E and RTL8211F (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix when PTP clock is register and unregister (Izabela Bakollari) [RHEL-121401]
  - net: phy: as21xxx: better handle PHY HW reset on soft-reboot (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_vendor() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for MxL86111 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: fix indentation in struct phy_driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for led_brightness_set op (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: add support for AQR115 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: promote AQR813 and AQR114C to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename aqr113c_config_init() to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reimplement aqcs109_config_init() as aqr_gen2_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen3_config_init() for AQR112 and AQR412(C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen2_fill_interface_modes() for AQCS109 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge and rename aqr105_read_status() and aqr107_read_status() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: use cached GLOBAL_CFG registers in aqr107_read_rate() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: remove handling for get_rate_matching(PHY_INTERFACE_MODE_NA) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: save a local shadow of GLOBAL_CFG register values (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: fill supported_interfaces for all aqr_gen2_config_init() callers (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename some aqr107 functions according to generation (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reorder AQR113C PMD Global Transmit Disable bit clearing with supported_interfaces (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge aqr113c_fill_interface_modes() into aqr107_fill_interface_modes() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename AQR412 to AQR412C and add real AQR412 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Replace hardcoded pages with defines (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce lanphy_modify_page_reg (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Start using PHY_ID_MATCH_MODEL (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix timestamping for vsc8584 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed: remove usage of a faux device (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: report and configure in-band auto-negotiation for SGMII/QSGMII (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: convert RTL8226-CG to c45 only (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521 (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: fix the PHY ID mismatch issue when using C45 (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: add proper reset flags for LAN8710A (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix parsing of unicast frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Enable WoL support using shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: Add PHY counter support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Don't register LEDs for genphy (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add ksz9131_resume() (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: PHY initialization (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm5481x: MII-Lite activation (Izabela Bakollari) [RHEL-121401]
  - net: phy: MII-Lite PHY interface mode (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Izabela Bakollari) [RHEL-121401]
  - net: phy: declare package-related struct members only if CONFIG_PHY_PACKAGE is enabled (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink_sfp_select_interface_speed() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: clear SFP interfaces when not in use (Izabela Bakollari) [RHEL-121401]
  - net: phylink: restrict SFP interfaces to those that are supported (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: move the WoL function to shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: air_en8811h: Introduce resume/suspend and clk_restore_context to ensure correct CKO settings after network interface reinitialization. (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add error handling to rtl8211f_get_wol (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add interface types for 50G and 100G (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: at803x: Add Qualcomm IPQ5018 Internal PHY support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add c45_phy_ids sysfs directory entry (Izabela Bakollari) [RHEL-121401]
  - net: phy: add flag is_genphy_driven to struct phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: add Kconfig symbol PHY_PACKAGE (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_package a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: make mdio consumer / device layer a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: remove Kconfig symbol MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: factor out provider part from mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - mdio: fix CONFIG_MDIO_DEVRES selects (Izabela Bakollari) [RHEL-121401]
  - net: ethernet: Add missing depends on MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: move __phy_package_[read|write]_mmd to phy_package.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve rgmii_clock() documentation (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: switch to adaptive polling and remove random delays (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: remove redundant 600ms post-reset delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: implement soft reset with asymmetric delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: directly copy struct mdio_board_info in mdiobus_register_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve mdio-boardinfo.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of struct mdio_board_entry to mdio-boardinfo.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify mdiobus_setup_mdiodev_from_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify phy_get_internal_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of genphy_c45_driver to phy_device.c (Izabela Bakollari) [RHEL-121401]
  - net/mdiobus: Fix potential out-of-bounds read/write access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Fix memory leak when using one step timestamping (Izabela Bakollari) [RHEL-121401]
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear phydev->devlink when the link is deleted (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: Add Airoha AN7583 PHY support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add support for Aeonsemi AS21xxx PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce genphy_match_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm87xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: pass PHY driver to .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: transition to the faux device interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: HWMON support for standalone versions of RTL8221B and RTL8251 (Izabela Bakollari) [RHEL-121401]
  - xen/netfront: stop tx queues during live migration (Thilak KN) [RHEL-134437]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-685.el9]
changelog:
  - gpio: tegra186: Fix GPIO name collisions for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Use generic macro for port definitions (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra256 (Jennifer Berringer) [RHEL-135121]
  - dt-bindings: gpio: Add Tegra256 support (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: fix resource handling in ACPI probe path (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Replace of_node_to_fwnode() with more suitable API (Jennifer Berringer) [RHEL-135121]
  - tools headers arm64: Add NVIDIA Olympus part (Charles Mirabile) [RHEL-138475]
  - perf arm-spe: Add NVIDIA Olympus to neoverse list (Charles Mirabile) [RHEL-138475]
  - soc/tegra: fuse: Do not register SoC device on ACPI boot (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Fix crash in tegra_fuse_readl() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add ACPI support for Tegra194 and Tegra234 (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to print SKU info (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to add lookups (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add tegra_acpi_init_apbmisc() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Refactor resource mapping (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use dev_err_probe for probe failures (Jennifer Berringer) [RHEL-135125]
  - mm/util: Introduce kmemdup_array() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use devm_platform_get_and_ioremap_resource() (Jennifer Berringer) [RHEL-135125]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-686.el9]
changelog:
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]
  - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]
  - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]
  - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.el9]
changelog:
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]
  - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]
  - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.1.1.el9_8]
changelog:
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}
  - redhat: update self-test data (Patrick Talbert)
  - redhat: set defaults for 9.8 (Patrick Talbert)
  - gitlab-ci: disttag override for 9.8 (Patrick Talbert)
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.2.1.el9_8]
changelog:
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]
  - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]
  - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]
  - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.3.1.el9_8]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
  - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
  - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.4.1.el9_8]
changelog:
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.50.1.el9_7]
changelog:
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
  - md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.51.1.el9_7]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.53.1.el9_7]
changelog:
  - tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.54.1.el9_7]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.55.1.el9_7]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174561] {CVE-2026-43284}


author: Tomas Halman <thalman@redhat.com> - 2.7.0-12
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.9-1
changelog:
  - Update to upstream 2.9 tarball
  - Update to changing SONAME (libabigail.so.8.0.0)
  - Simplify the %check section
  - Resolves: RHEL-121666


author: Ales Matej <amatej@redhat.com> - 0.69.0-18
changelog:
  - Fix a crash when parsing multiple key files fails (RHEL-145618)
  - Mark all protected packages as user installed for all transactions (RHEL-76112)
  - Add `filterUnneededExtraUserinstalled` and Python version to the API
  - Describe all problems even when there are protected removals (RHEL-115194)
  - Clearer error for protected package broken dependencies


author: Karel Zak <kzak@redhat.com> 2.37.4-22
changelog:
  - fix RHEL-113638 - lscpu: update ARM identifiers
  - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification


author: Karel Zak <kzak@redhat.com> 2.37.4-23
changelog:
  - fix RHEL-123527 - mount: improve --all documentation
  - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-16
changelog:
  - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543)
  - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238)


author: Jeff Moyer <jmoyer@redhat.com> - 2.12-1.el9
changelog:
  - Rebase to version 2.12.  Follow fedora and get rid of explicit %
    attr for library files
  - Resolves: RHEL-114115


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-3
changelog:
  - util: json: Increase JSON nesting limit when parsing to 300 (RHEL-135128)
  - virjsontest: Add test for nesting depth (RHEL-135128)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-134127)
  - esx: URI encode inventory objects twice (RHEL-134127)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624)
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126345)
  - qemu: Introduce privateData for hostdevs (RHEL-126345)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126345)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126345)
  - qemu: open iommufd FD from libvirt backend (RHEL-126345)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614)
  - qemu: Implement support for persistent reservation migration control (RHEL-140614)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866)
  - Introduce support for disk operation latency histogram collection (RHEL-147866)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353)
  - util: Move openning IOMMU device to viriommufd (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353)
  - util: Move openning VFIO device to virpci (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150353)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353)
  - qemu: Save IOMMUFD state into status XML (RHEL-150353)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150353)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353)
  - conf: Introduce iommufd enum for domaincaps (RHEL-138544)
  - qemu: Fill iommufd domain capability (RHEL-138544)
  - tests: properly mock VFIO and IOMMU checks (RHEL-138544)
  - iommufd: fix FD leak in case of error (RHEL-150353)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - domain_conf: initialize network hostdev private data (RHEL-151953)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.9.el9_7
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154551)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154551)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154551)
  - docs: Clarify host-model description in domain capabilities (RHEL-154551)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
changelog:
  - Update to openwsman-2.8.1
    Resolves: RHEL-97643
  - Add libwsman-client.so.4 for backward compatibility
    Related: RHEL-97643


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-127516
  - Fix bogus 'sscg' arguments
    Related: RHEL-118292


author: Toke Høiland-Jørgensen <toke@redhat.com> 1.5.7-1
changelog:
  - Upstream version bump
  - Add annocheck exceptions for BPF objects (Felix)
  - Re-enable debug builds (Felix)
  - Add libcap-ng-devel to BuildDepends


author: RHEL Packaging Agent <jotnar@redhat.com> - 0.3.24-1
changelog:
  - Rebase to 0.3.24
  - Add missing libzstd-devel BuildRequires
  - Add missing files to the %files tests section
  - Resolves: RHEL-116442


author: Olivier Fourdan <ofourdan@redhat.com> - 40.9-31
changelog:
  - Backport linux-dmabuf v4 support to restore hardware acceleration
    in Xwayland 24.1 with Mesa 25.2
    Resolves: RHEL-129832


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-25
changelog:
  - Resolves: RHEL-114935 - Image mode: The dir /var/lib and /var/log
    is not created when updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28
changelog:
  - Resolves: RHEL-146528 - CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connection


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-28.1
changelog:
  - RHEL-159560 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - RHEL-159539 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - RHEL-159447 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - RHEL-157888 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-24.2
changelog:
  - Resolves: RHEL-159557 - CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159536 - CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - Resolves: RHEL-159444 - CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-157885 - CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Mingyu Shi <mshi@redhat.com> - 2.2.50-1
changelog:
  - Upgrade to 2.2.50
  - Support MAC referring for VLAN in gen_conf. RHEL-110369
  - Introduce state: ignore for route. RHEL-107130
  - Support PCI address matching in gen_conf. RHEL-110369
  - Support MacSec interface in gen_conf. RHEL-110369


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Automatically set HSR port MAC address. RHEL-122171
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121992


author: Gris Ge <fge@redhat.com> - 2.2.56-1
changelog:
  - Upgrade to 2.2.56
  - Allow using VRF name to specify route table. RHEL-123541
  - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-125052
  - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-126731
  - Support rightca ipsec option. RHEL-123542


author: Mingyu Shi <mshi@redhat.com> - 2.2.58-1
changelog:
  - Upgrade to 2.2.58
  - vrf: Handle ignore interface when verifying desired state. RHEL-141606
  - alt-name: Remove alt-names when interface marked as absent. RHEL-141602
  - hsr: Automatically disable IP on hsr port. RHEL-141609
  - hsr: add support for configuring "interlink" property. RHEL-141608
  - Support referring interface name using its alternative name. RHEL-141601


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75139, ep11 token BLS support
  - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100059, openCryptoki 3.26.0


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.7-1
changelog:
  - Rebase to 2025.7
    Backport https://github.com/ostreedev/ostree/pull/3555
    Resolves: #RHEL-129049


author: RHEL Packaging Agent <jotnar@redhat.com> - 7.2.0-1
changelog:
  - Rebase to papi 7.2.0
  - Update license tag to BSD-3-Clause
  - Remove old patches and add new patches for 7.2.0 compatibility
  - Update configure options and package files
  - Resolves: RHEL-121673


author: Miro Hrončok <miro@hroncok.cz> - 1.17.0-1
changelog:
  - Add the -M flag to %pyproject_save_files
  - The flag can be used to indicate no Python modules should be saved


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.0-1
changelog:
  - Make %pyproject_buildrequires -t/-e and %tox fail when no suitable tox configuration exists
  - The %pyproject_buildrequires -t/-e case is temporarily allowed on Fedora 40-42
  - Requires tox-current-env >= 0.0.16


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.3-1
changelog:
  - %pyproject_buildrequires: Do not generate BuildRequires from Requires core metadata fields
  - That field is deprecated and should include importable module names, not distribution packages
  - Related: rhbz#2378463


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.4-1
changelog:
  - Don't exit from pyproject-srpm-macros implementation of %pyproject_buildrequires
  - Fixes: rhbz#2391290
  - On RPM 4.20+ don't put pyproject-macros-specific files in %buildsubdir
  - Works around https://github.com/rpm-software-management/rpm/issues/3890
  - Speed %pyproject_save_files up significantly


author: Miro Hrončok <mhroncok@redhat.com> - 1.18.5-1
changelog:
  - %pyproject_extras_subpkg: Only %ghost the dist-info directory, not the content
  - That way, accidentally unpackaged files within are reported as errors
  - %pyproject_save_files: Also save top level typing stub files (.pyi)


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143117
  Resolves: RHEL-143174
  Resolves: RHEL-144897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143117, RHEL-143174, RHEL-144897


author: David Hanina <dhanina@redhat.com> - 4.12.2-22.4
changelog:
  - Resolves: RHEL-155038 Pagure #9953: Adding a group with 32Bit Idrange fails.
  - Resolves: RHEL-153628 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-153621 Pagure #9854: Erroneous case-sensitivity in offline DSE lookup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-24
changelog:
  - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-25
changelog:
  - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9]
  - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
  - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
  - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
  - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
  - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package 
  - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
  - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
changelog:
  - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache 
  - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
  - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service 
  - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
  - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
changelog:
  - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates
  - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS
  - Resolves: RHEL-141297 Memory leaks in IPA plugins
  - Resolves: RHEL-141054 IPA fails to sign zone
  - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
changelog:
  - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
  - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive
  - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system)
  - RHEL-145854 Include latest fixes in python3-ipatests package
  - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
  - RHEL-141500 ipa use systemd-sysusers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
changelog:
  - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured"
  - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-6
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143110
  Resolves: RHEL-143170
  Resolves: RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-7
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143110, RHEL-143170, RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143112
  Resolves: RHEL-143172
  Resolves: RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-6
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143112, RHEL-143172, RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.14.0-2
changelog:
  - Initial package
  - Fedora contributions by:
        Björn Esser <besser82@fedoraproject.org>
        Bohuslav Kabrda <bkabrda@redhat.com>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jason ティビツ <tibbs@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Lukáš Zachar <lzachar@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Marcel Plch <mplch@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Michal Toman <mtoman@fedoraproject.org>
        Miro Hrončok <mhroncok@redhat.com>
        Nicolas Chauvet <kwizart@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Šplíchal <psplicha@redhat.com>
        Petr Viktorin <pviktori@redhat.com>
        Rex Dieter <rdieter@fedoraproject.org>
        Richard W.M. Jones <rjones@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Sahana Prasad <sahana@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Till Maas <opensource@till.name>
        Tom Stellard <tstellar@redhat.com>
        Tomas Mraz <tmraz@fedoraproject.org>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        U2FsdGVkX1 <U2FsdGVkX1@gmail.com>
        Victor Stinner <vstinner@redhat.com>
        Ville Skyttä <ville.skytta@iki.fi>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672,CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-11468, CVE-2025-15366,
  CVE-2025-15367
  Resolves: RHEL-144896, RHEL-143115, RHEL-143173


author: Tomáš Hrnčiar <thrciar@redhat.com> - 1.6.0-3
changelog:
  - Initial package
  - Fedora contributions by:
        Alfredo Moralejo <amoralej@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Matthias Runge <mrunge@redhat.com>
        Miro Hrončok <mhroncok@redhat.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Priscila Gutierres <pgutier@redhat.com>
        Thomas Moschny <thomas.moschny@gmx.de>
        Tomas Orsava <torsava@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.10-3
changelog:
  - Initial package
  Fedora contributions by:
      Ales Nezbeda <anezbeda@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Bohuslav Kabrda <bkabrda@redhat.com>
      Charalampos Stratakis <cstratak@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Devrim Gündüz <devrim@gunduz.org>
      Filip Januš <fjanus@redhat.com>
      Honza Horak <hhorak@redhat.com>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jason L Tibbitts III <tibbs@math.uh.edu>
      Jesse Keating <jkeating@fedoraproject.org>
      Jozef Mlich <jmlich@redhat.com>
      Lumír Balhar <lbalhar@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Ondřej Sloup <ondrej.sloup@protonmail.com>
      Patrik Novotný <panovotn@redhat.com>
      Pavel Raiskup <praiskup@redhat.com>
      Petr Kubat <pkubat@redhat.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Todd Zullinger <tmz@pobox.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Lane <tgl@redhat.com>


author: Cristian Le <git@lecris.dev> - 2.13.6-7
changelog:
  - Refactor the build script
  - Drop the python3-python2 distinction
  - Use standard cmake and pyproject macros (rhbz#2377381)
  - Allow to build with arbitrary generator (rhbz#2381106)


author: Lukáš Zachar <lzachar@redhat.com> - 78.1.1-3
changelog:
  - Adjust gating
  - Generic gating.yaml for all rhel
  - Use CS repos instead of Fedora
  - Remove python versions not available on c9s
  - use python-isort to test


author: Vladislav Dronov <vdronov@redhat.com> - 1.0.0-1
changelog:
  - Update to qat-zstd-plugin 1.0.0 @ 1e8b930c (RHEL-72905)
  - NUMA node aware mem allocations and other Code optimizations
  - Bug Fixes and Static analysis Fixes (OpenScanhub and Latest Coverity)
  - Support ZSTD v1.5.7 and README refactor
  - Spec file updates for RPM Packaging


author: Vladislav Dronov <vdronov@redhat.com> - 25.08.0-1
changelog:
  - Update to qatlib 25.08.0 @ 686d209b (RHEL-91078)
  - Add autoconf-archive as a dependency
  - Add update_sample to qatlib-tests
  - Add manpage for cpa_sample_code
  - Add sysusers.d config file to allow rpm to create users/groups automatically


author: Veronika Doubkova <vdoubkov@redhat.com> - 9.7-0.8
changelog:
  - Refactor SB certificates to versioned files with symlinks and revert UKI to 504
  - Resolves: RHELBLD-17477


author: Peter Koprda <pkoprda@redhat.com> - 0.2.7-4
changelog:
  - Update yggdrasil to 0.2.7.2
  - Update yggdrasil-worker-package-manager to 0.1.3.2
  - Resolves: RHEL-160833
  - Resolves: CVE-2026-33186


author: Matyas Horky <mhorky@redhat.com> - 0.2.7-3
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2025-61729
  - Resolves: RHEL-140560
  - Resolves: CVE-2025-61726
  - Resolves: RHEL-146045
  - Resolves: CVE-2025-68121
  - Resolves: RHEL-149647


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83136
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83044


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86104
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-86130


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171254


author: Petr Stodulka <pstodulk@redhat.com> - 0.20.0-2
changelog:
  - Bump leapp-framework to 6.2
  - Add possibility to specify aliases for CLI option
  - Resolves: RHEL-128269


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-66
changelog:
  - Use systemd-sysusers for the 'pegasus' user and group creation
  - Fix Requires of subpackages
    Related: RHEL-90737
  - Add support for Image Mode
    Resolves: RHEL-90737


author: Petr Menšík <pemensik@redhat.com> - 1.24.2-2
changelog:
  - Switch TLS configuration to follow TLS sockets by crypto-policy again
    (RHEL-147860)
  - Change the default of tls-use-system-policy-versions at build-time


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.3.12-1
changelog:
  - Rebase to version 2.3.12
  - Add unixODBC-c89.patch for GCC 14 compatibility
  - Update so-version-bump.patch for new version
  - Fix multilib_fix_c_header path to match actual header location
  - Resolves: RHEL-94798


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119977), CVE-2025-62230 (RHEL-120023),
                 CVE-2025-62231 (RHEL-125018)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-6
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163198
    Resolves: https://redhat.atlassian.net/browse/RHEL-163294
    Resolves: https://redhat.atlassian.net/browse/RHEL-163252


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119963), CVE-2025-62230 (RHEL-120035),
                 CVE-2025-62231 (RHEL-125003)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-33
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163225
    Resolves: https://redhat.atlassian.net/browse/RHEL-163307
    Resolves: https://redhat.atlassian.net/browse/RHEL-163238


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-1.1
changelog:
  - Resolves: RHEL-163816
  - Resolves: RHEL-163837

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Frédéric Bérat <fberat@redhat.com> - 2.34-265
changelog:
  - Fix null pointer dereference and assertion failures in __nss_database_get
    (bug 28940) (RHEL-150269)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.2.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172543]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172543] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172543]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172543] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172543]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.3.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.1.el9_8
changelog:
  - conf: Parse hyperv features even for host-model (RHEL-151684)
  - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684)


author: David Hanina <dhanina@redhat.com> - 4.13.1-3.1
changelog:
  - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z]
  - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z]
  - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z]
  - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  Related: RHEL-168159, RHEL-167917


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-168159, RHEL-167917


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367
  Resolves: RHEL-144896, RHEL-143115, RHEL-143173


author: Karolina Surma <ksurma@redhat.com> - 3.14.4-1
changelog:
  - Update to Python 3.14.4
  - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
  Related: RHEL-167918, RHEL-168160


author: Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
  Resolves: RHEL-167918, RHEL-168160


author: Peter Koprda <pkoprda@redhat.com> - 0.2.7-5
changelog:
  - Update yggdrasil to 0.2.7.2
  - Update yggdrasil-worker-package-manager to 0.1.3.2
  - Resolves: RHEL-169909
  - Resolves: CVE-2026-33186


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-17
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161679)


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.1
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-163097, RHEL-163113


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.2
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482
    Resolves: RHEL-161519, RHEL-161085, RHEL-168463


author: Tomas Halman <thalman@redhat.com> - 1.6-19.2
changelog:
  - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
  - Resolves: RHEL-168185


author: Zdenek Petracek <zpetrace@redhat.com> - 0.2.7-6
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2026-32283
  - Resolves: RHEL-167686
  - Resolves: CVE-2026-32282
  - Resolves: RHEL-166690


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-170368


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163199
    Resolves: https://redhat.atlassian.net/browse/RHEL-163295
    Resolves: https://redhat.atlassian.net/browse/RHEL-163253


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163226
    Resolves: https://redhat.atlassian.net/browse/RHEL-163308
    Resolves: https://redhat.atlassian.net/browse/RHEL-163239


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Jan Grulich <jgrulich@redhat.com> - 1.12.9-4.1
changelog:
  - Fix arbitrary code execution via crafted symlinks in sandbox-expose options
    Resolves: RHEL-165643
  - Fix arbitrary file deletion on host via improper cache file path validation
    Resolves: RHEL-170171


author: Stephen Bourke <sbourke@redhat.com> - 0.2.7-7
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2026-32280
  - Resolves: RHEL-175431
  - Resolves: CVE-2026-32281
  - Resolves: RHEL-177312


author: Jan Grulich <jgrulich@redhat.com> - 0.6.22-6.1
changelog:
  - Fix integer underflow in MakerNote decoding (CVE-2026-40386)
  - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385)
    Resolves: RHEL-170253, RHEL-170234


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Phil Sutter <psutter@redhat.com> [1.0.9-7.el9]
changelog:
  - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461]
  - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461]


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.0.0-5
changelog:
  - Emulate a zero axis events after REL_WHEEL (RHEL-153540)
  - Fix ToolSerials assignment for serials greater than INT_MAX (RHEL-153532)


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.1
changelog:
  - Fix CVE-2026-33278 (RHEL‑177822)
    Fix CVE-2026-42944 (RHEL-177936)
    Fix CVE-2026-42959 (RHEL-177797)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.2.el9_8
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154552)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154552)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154552)
  - docs: Clarify host-model description in domain capabilities (RHEL-154552)
  - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159913)
  - security: Cleanup hostdev label error logic (RHEL-159913)
  - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159913)
  - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159174)
  - conf: Move and rename virStorageSourceFDTuple object (RHEL-159174)
  - conf: Refactor virHostdevIsPCIDevice (RHEL-159174)
  - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159174)
  - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159174)
  - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159174)
  - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159174)
  - conf: Introduce domain iommufd element (RHEL-159174)
  - qemu: Implement iommufd (RHEL-159174)
  - conf: Add iommufd fdgroup support (RHEL-159174)
  - qemu: Implement iommufd fdgroup (RHEL-159174)
  - tests: Add iommufd fdgroup test (RHEL-159174)
  - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159174)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.3.el9_8
changelog:
  - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822)
  - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822)
  - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-178822)
  - qemu_capabilities: Always sort features in host-model CPU (RHEL-178822)
  - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Cache expanded CPU (RHEL-178822)
  - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-178822)
  - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-178822)
  - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-178822)
  - cpu: Introduce virCPUUpdateFeatures (RHEL-178822)
  - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-178822)
  - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-178822)
  - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-178822)
  - distro: Replace old gating with tmt


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.13.1.el9_8]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
  - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
  - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
  - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
  - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
  - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
  - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-9
changelog:
  - Security release for CVE-2026-1933 CVE-2026-2340  CVE-2026-3012
    CVE-2026-4480 CVE-2026-40170 CVE-2026-4408
  - resolves: RHEL-156319 - CVE-2026-1933 CVE-2026-2340 CVE-2026-3012 samba:
    various flaws
  - resolves: RHEL-161657 - CVE-2026-4480 - Fix Samba printing
  - resolves: RHEL-170597 - CVE-2026-40170 - Update bundled ngtcp2
  - resolves: RHEL-166868 - Add stack protection with FORTIFY_SOURCE


author: Tanishi Srivastava <tsrivast@redhat.com> [5.14.0-687.14.1.el9_8]
changelog:
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
  - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
  - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
  - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
  - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
  - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
  - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
  - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
  - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
  - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
  - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
  - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
  - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.15.1.el9_8]
changelog:
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
  - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-7
changelog:
  - Resolves: RHEL-152356 - Getting "build_candidate_list - Database error 11" messages after migrating to LMDB. [rhel-9.8.z]
  - Resolves: RHEL-168967 - Web console doesn't show the sub suffix of ou=foo,ou=people,dc=example,dc=com. [rhel-9.8.z]
  - Resolves: RHEL-170269 - DS 12 does not handle escape char in bind user [rhel-9.8.z]
  - Resolves: RHEL-174524 - [RFE] Add OS-level thread names to all server threads [rhel-9.8.z]
  - Resolves: RHEL-178086 - CVE-2026-9064 389-ds-base: 389-ds-base: unbounded LDAP controls count in get_ldapmessage_controls_ext() causes CPU and heap amplification (remote DoS) [rhel-9.8]
  - Resolves: RHEL-180716 - Online export is failing when using the option "-s" [rhel-9.8.z]
  - Resolves: RHEL-183895 - Server shutdown during online reindex may lead to data loss [rhel-9.8.z]


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263
    Resolves: https://redhat.atlassian.net/browse/RHEL-182426


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34.1
changelog:
  - CVE fix for: CVE-2026-50256, CVE-2026-50257, CVE-2026-50258,
                 CVE-2026-50259, CVE-2026-50260, CVE-2026-50261,
                 CVE-2026-50262, CVE-2026-50263, CVE-2026-50264
    Resolves: https://redhat.atlassian.net/browse/RHEL-182435


author: Petr Khartskhaev <pkhartsk@redhat.com> - 13.23-3
changelog:
  - Backport fix for CVE-2026-6478 from PostgreSQL 14.23
  - Backport fixes for CVE-2026-6637, CVE-2026-6477, CVE-2026-6475, CVE-2026-6473
  - Resolves: RHEL-179799
  - Resolves: RHEL-181866
  - Resolves: RHEL-181950
  - Resolves: RHEL-181964


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.16.1.el9_8]
changelog:
  - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
  - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
  - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
  - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
  - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
  - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
  - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.17.1.el9_8]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
  - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
  - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-43
changelog:
  - Update how GDM handles Registering session/display
    to properly terminate plymouth
    Resolves: https://redhat.atlassian.net/browse/RHEL-178706


author: Joan Torres Lopez <joantolo@redhat.com> - 40.1-44
changelog:
  - Create display in "legacy-xorg" mode checking displays in tty
    Resolves: https://redhat.atlassian.net/browse/RHEL-180820


author: Miro Hrončok <mhroncok@redhat.com> - 3.14.5~rc1-1
changelog:
  - Update to 3.14.5rc1
  - Move back to the generational from the incremental garbage collector
  - Security fix for CVE-2026-6019
  Resolves: RHEL-180642


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
changelog:
  - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
    the spec has
  - Resolves: RHEL-176576


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28.3
changelog:
  - Resolves: RHEL-178684 - nginx: code execution and denial of
    service (CVE-2026-9256)
  - Resolves: RHEL-182553 - nginx: HTTP/2: Remote Denial of Service via
    compression bomb and Slowloris-style attack


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.18.1.el9_8]
changelog:
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
  - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
  - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
  - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
  - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
  - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
  - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
  - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
  - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
  - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
  - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
  - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
  - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
  - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
  - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
  - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
  - net: Fix typos (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
  - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
  - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
  - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
  - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
  - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
  - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
  - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
  - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
  - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.19.1.el9_8]
changelog:
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
  - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
  - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
  - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
  - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
  - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
  - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
  - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
  - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
  - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
  - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
  - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
  - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
  - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.20.1.el9_8]
changelog:
  - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
  - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
  - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
  - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171256


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-167
changelog:
  - Fix information disclosure via MITM attack bypassing TLS in net-imap.
    (CVE-2026-42246)
    Resolves: RHEL-181763
  - Fix command injection via Symbol arguments in net-imap. (CVE-2026-42258)
    Resolves: RHEL-181802


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.21.1.el9_8]
changelog:
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
  - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
  - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.22.1.el9_8]
changelog:
  - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
  - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
  - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
  - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
  - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-8
changelog:
  - Resolves: RHEL-182159 - CVE-2026-11610 389-ds-base: 389-ds-base: Heap buffer overflow in sasl_io_recv() via padded SASL UNBIND [rhel-9.8.z]
  - Resolves: RHEL-183103 - CVE-2026-11774 389-ds-base: 389-ds-base: integer overflow in SASL packet length bypasses size limit leading to heap buffer overflow [rhel-9.8.z]


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28.4
changelog:
  - Resolves: RHEL-190800 - nginx: "HTTP/2 bomb" nginx fix breaks module ABI
    causing crashes
  - Resolves: RHEL-188418 - nginx: NGINX: Arbitrary code execution or 
    Denial of Service via heap-based buffer overflow with crafted HTTP/2
    headers (CVE-2026-42055)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.23.1.el9_8]
changelog:
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180773]
  - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
  - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.1
changelog:
  - Fix CVE-2026-33278 (RHEL-177822)
    Fix CVE-2026-42944 (RHEL-177936)
    Fix CVE-2026-42959 (RHEL-177797)


author: Fedor Vorobev <fvorobev@redhat.com> - 1.24.2-3.2
changelog:
  - Fix CVE-2026-40622 (RHEL-184840)
    Fix CVE-2026-44390 (RHEL-186688)
    Fix CVE-2026-41292 (RHEL-187352)
    Fix CVE-2026-42534 (RHEL-187095)


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
changelog:
  - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
    formula compilation
  - Resolves: RHEL-186062


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-4.1
changelog:
  - Fix for CVE-2026-52720: validate framebuffer update rectangles
    in librfb plugin
    Resolves: RHEL-184459


author: Tomas Pelka <tpelka@redhat.com> - 1.22.12-7.1
changelog:
  - Sync with c9s release -5..-7: fix for CVE-2026-2923, CVE-2026-3082
    in dvbsuboverlay and jpegparser
    Resolves: RHEL-156242, RHEL-156255


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.24.1.el9_8]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.25.1.el9_8]
changelog:
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
  - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
  - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
  - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4.3
changelog:
  - CVE fix for: CVE-2026-55999, CVE-2026-56000
    Resolves: https://redhat.atlassian.net/browse/RHEL-191532
    Resolves: https://redhat.atlassian.net/browse/RHEL-191524


author: Aaron Merey <amerey@redhat.com> - 7.2.0-1.1
changelog:
  - Generate Fortran headers deterministically to fix multilib file
    conflict on papi-devel. (RHEL-145965, RHEL-180678)


author: Miro Hrončok <mhroncok@redhat.com> - 3.9.25-7.1
changelog:
  - Fix ssl.SSLError: [ASN1: NOT_ENOUGH_DATA] not enough data with OpenSSL 3.5.7+
  Resolves: RHEL-194207


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 2.68.4-19.2
changelog:
  - Fix CVE-2026-58016: broken node element nesting validation in
    D-Bus introspection XML parsing
  - Resolves: RHEL-190632


author: Justin Stephenson <jstephen@redhat.com> - 2.9.8-5
changelog:
  - Resolves: RHEL-192063 CVE-2026-14474 sssd: sudo ldap provider searches entire directory tree for sudorole objects by default, enabling privilege escalation
  - Resolves: RHEL-192070 CVE-2026-14476 sssd: path traversal in SSSD AD GPO provider allows writing files outside GPO cache directory as root


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.27.1.el9_8]
changelog:
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
  - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
  - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
  - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
  - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
  - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
  - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
  - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
  - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
  - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
  - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
  - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
  - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
  - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
  - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.28.1.el9_8]
changelog:
  - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.29.1.el9_8]
changelog:
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.20.0.8-1
changelog:
  - Update to jdk-17.0.20+8 (GA)
  - Add to .gitignore openjdk-17.0.20+8.tar.xz
  - Set updatever to 20
  - Set buildver to 8
  - Update sources to openjdk-17.0.20+8.tar.xz
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-188875


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.20.0.8-1.1
changelog:
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field (OPENJDK-4876)


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.20.0.8-1.1
changelog:
  - Set tzdata requires and build requires to 2026b
  - Set fipsver to 821eb26f706
  - Delete comments about patch macro syntax
  - Set bundled freetype version to 2.14.3
  - Set bundled giflib version to 6.1.3
  - Set bundled harfbuzz version to 14.2.0
  - Set bundled lcms2 version to 2.19.1
  - Set bundled libpng version to 1.6.58


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-3.1
changelog:
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Add 25u backports of JDK-8347901 & JDK-8378713 C2 performance fixes
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-155330
  - Related: RHEL-156040
  - Resolves: RHEL-149785
  - Resolves: RHEL-211047
  - Resolves: RHEL-211051


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.3.0.9-3.2
changelog:
  - Add family option with name argument to alternatives install lines (OPENJDK-4854)
  - Resolves: RHEL-211053


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.4.0.7-1.0
changelog:
  - Update to jdk-25.0.4+7 (GA)
  - Update release notes to 25.0.4+7
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Drop local copy of JDK-8375294 EOPNOTSUPP patch
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Revert fr_FR and de_DE changes made in d43f0e6186370fdeb0ca2f3594f39783e20eef1c now JDK-8382020 is fixed
  - Simplify TestTranslations run now there is only the CLDR provider and one set of data (JDK-8174269)
  - Make zone string debug output optional in TestTranslations
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-188880
  - Resolves: RHEL-212293
  - Resolves: RHEL-212297


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.11.0.10-1.3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
  - Make headless own /usr/share/doc/java-1.8.0-openjdk
  - Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
  - Resolves: RHEL-151167
  - Resolves: RHEL-212348
  - Resolves: RHEL-212349


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.1
changelog:
  - Update to jdk-21.0.12+8 (GA)
  - Update release notes to 21.0.12+8
  - Bump freetype version to 2.14.3 following JDK-8385390
  - Bump giflib version to 6.1.3 following JDK-8384902
  - Bump HarfBuzz version to 14.2.0 following JDK-8385490
  - Bump lcms2 version to 2.19.1 following JDK-8375065 & JDK-8383354
  - Bump libpng version to 1.6.58 following JDK-8384495
  - Update tagging scripts to include signature checks and correctly handle gating
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Obsolete old RHEL releases (9.7.0-z, 10.1-z)
  - Make zone string debug output optional in TestTranslations
  - Change javadoc-zip to just own the top-level directory, not include the entire subtree
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212332
  - Resolves: RHEL-212334
  - Resolves: RHEL-212336
  - Resolves: RHEL-151193
  - Resolves: RHEL-212341
  - Resolves: RHEL-188866
  - Resolves: RHEL-212345
  - Resolves: RHEL-212347
  - Related: RHEL-212349


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.12.0.8-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212332
  - Related: RHEL-212334
  - Related: RHEL-212336
  - Related: RHEL-151193
  - Related: RHEL-212341
  - Related: RHEL-188866
  - Related: RHEL-212345
  - Related: RHEL-212347
  - Related: RHEL-151167
  - Related: RHEL-212348
  - Related: RHEL-212349


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Make headless own /usr/share/doc/java-1.8.0-openjdk
  - Make javadoc-zip own /usr/share/javadoc/java-1.8.0-openjdk
  - Do not overwrite slowdebug __provides_exclude_from and __requires_exclude_from regexps
  - Resolves: RHEL-212327
  - Resolves: RHEL-212328


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.1
changelog:
  - Update to 8u502-b07 (GA).
  - Update release notes for 8u502-b07.
  - Bump lcms2 version to 2.19.1 following JDK-8321489, JDK-8348110, JDK-8375065 & JDK-8383354
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Require tzdata 2026b due to upstream inclusion of JDK-8383175
  - Add attempted patch for JDK-8385876 to fix -Wnonnull build failure with s390x Zero on CentOS 9
  - Remove macro references in comments where possible (- Move version information and core NVR definitions back towards the top of the file
  - Explictly define supported architectures
  - Specify portablerelease and rpmrelease (always 0 for portables) in the Release field
  - Make zone string debug output optional in TestTranslations
  - Change javadoc-zip to just own the top-level directory, not include the entire subtree
  - Update tagged versions to include 9.8.0-z & 9.9.0.
  - Cleanup tagging and gating scripts to appease shellcheck:
  - * scripts/builds/build_vanilla.sh: Use an array to handle the varying arguments to rhpkg.
  - * scripts/builds/check_signatures.sh: Quote variable usage.
  - * scripts/builds/waive_issue.sh: Remove redundant 'test "x"' usage.
  - * scripts/builds/waive_leapp_issue.sh: Likewise.
  - * scripts/builds/waive_rpminspect.sh: Likewise.
  - * scripts/builds/waive_usual_rpminspect.sh: Likewise and add missing WORKING_DIR variable.
  - * scripts/builds/waive_usual_tier0.sh: Remove redundant 'test "x"' usage.
  - Obsolete old RHEL releases (8.2.0-z, 9.0.0-z, 9.7.0-z)
  - Sync the copy of the portable specfile with the latest update
  - Sync portable naming with later JDKs, due to adoption of <compatiblename> by portable
  - Drop <pversion> which is a redundant alias for version now
  - ** This tarball is embargoed until 2026-07-21 @ 1pm PT. **
  - Resolves: RHEL-212095
  - Resolves: RHEL-188852
  - Resolves: RHEL-149784
  - Resolves: RHEL-212316
  - Resolves: RHEL-212318
  - Related: RHEL-212327
  - Resolves: RHEL-212329
  - Resolves: RHEL-212330


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.502.b07-1.2
changelog:
  - Bump release for PQC build
  - Related: RHEL-212095
  - Related: RHEL-188852
  - Related: RHEL-149784
  - Related: RHEL-212316
  - Related: RHEL-212318
  - Related: RHEL-212329
  - Related: RHEL-212330
  - Related: RHEL-212327
  - Related: RHEL-212328


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.30.1.el9_8]
changelog:
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807}
  - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468]
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468]
  - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277]
  - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026}
  - scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412]
  - drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950}
  - ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006}
  - drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976}
  - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.31.1.el9_8]
changelog:
  - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}
  - futex: Drop CLONE_THREAD requirement for private default hash alloc (Audra Mitchell) [RHEL-193517] {CVE-2026-52973}
  - watchdog: Fix NULL pointer dereference when releasing cdev (Krzysztof Pawlinski) [RHEL-193729]
  - redhat/configs: enable watchdog pretimout panic functionality for x86 (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Fix ACPI table leak in probe function (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: Switch to use hrtimer_setup() (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Convert comma to semicolon (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: wdat_wdt: Add timeout value as a param in ping method (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Report firmware_version (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Set NO_REBOOT if the watchdog is not already running (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Using existing macro define covers more scenarios (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: No need to stop the timer in probe (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: only run driver set_pretimeout op if device supports it (Krzysztof Pawlinski) [RHEL-193729]
  - watchdog: iTCO_wdt: Make use of the helper function devm_platform_ioremap_resource() (Krzysztof Pawlinski) [RHEL-193729]
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - xfrm: Duplicate SPI Handling (Sabrina Dubroca) [RHEL-180033] {CVE-2025-39797}
  - iommu/vt-d: Avoid NULL pointer dereference or refcount corruption (Eder Zulian) [RHEL-190342] {CVE-2026-53281}
  - iommu/vt-d: Fix oops due to out of scope access (Eder Zulian) [RHEL-190342]
  - lib/buildid: use __kernel_read() for sleepable context (CKI Backport Bot) [RHEL-189962] {CVE-2026-23002}
  - nfsd: use correct loop termination in nfsd4_revoke_states() (CKI Backport Bot) [RHEL-188257]
  - nfsd: check that server is running in unlock_filesystem (CKI Backport Bot) [RHEL-188257]


author: Olivier Fourdan <ofourdan@redhat.com> - 2.0.3-12.1
changelog:
  - CVE fix for: CVE-2026-56001, CVE-2026-56002, CVE-2026-56003
    Resolves: https://redhat.atlassian.net/browse/RHEL-191886
    Resolves: https://redhat.atlassian.net/browse/RHEL-191933
    Resolves: https://redhat.atlassian.net/browse/RHEL-191938


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.2
changelog:
  - Fix buffer overflow in DTLS connection peer certificate
    subject DN handling (CVE-2026-59692)
    Resolves: RHEL-193572


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.22.12-7.3
changelog:
  - Fix incorrect bytes-per-pixel handling in rfbsrc plugin
    (CVE-2026-59691)
    Resolves: RHEL-193557


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.33.1.el9_8]
changelog:
  - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530}
  - ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.34.1.el9_8]
changelog:
  - s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430]
  - s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471]
  - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021]
  - timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214}
  - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273]


author: RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 1.7.1-12.1
changelog:
  - Fix CVE-2026-10846: DNS response spoofing via missing
    address/port/TXID and question section validation (RHEL-210701)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.35.1.el9_8]
changelog:
  - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-186331]
  - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-186331]
  - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-186331]
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() (CKI Backport Bot) [RHEL-179745] {CVE-2026-43450}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.36.1.el9_8]
changelog:
  - powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Mamatha Inamdar) [RHEL-215575]
  - powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Mamatha Inamdar) [RHEL-215575]
  - mm/vmscan: add sysctl to limit direct reclaim scanning depth (Audra Mitchell) [RHEL-211058]
  - mm/memcg: refactor try_charge_memcg retry logic to use for loop (Audra Mitchell) [RHEL-211058]
  - mm/memcg: introduce tunable sysctl for memory cgroup reclaim retries (Audra Mitchell) [RHEL-211058]
  - futex: Prevent lockup in requeue-PI during signal/ timeout wakeup (Waiman Long) [RHEL-193526] {CVE-2026-52977}
  - futex: Require sys_futex_requeue() to have identical flags (Waiman Long) [RHEL-193526] {CVE-2026-31554}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path (Waiman Long) [RHEL-193526] {CVE-2026-31555}
  - futex: Fix UaF between futex_key_to_node_opt() and vma_replace_policy() (Waiman Long) [RHEL-193526] {CVE-2026-23415}


author: Filip Janus <fjanus@redhat.com> - 13.23-4
changelog:
  - Backport fix for CVE-2026-6479 from PostgreSQL 14.23
    (SSL/GSS init causes denial of service via uncontrolled recursion)
  - Resolves: CVE-2026-6479


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.37.1.el9_8]
changelog:
  - s390/pkey: Check length in pkey_pckmo handler implementation (Ramesh Chhetri) [RHEL-215578]
  - s390/pkey: Check length in PKEY_VERIFYPROTK ioctl (Ramesh Chhetri) [RHEL-215580]
  - net: openvswitch: reject oversized nested action attrs (CKI Backport Bot) [RHEL-222495] {CVE-2026-64531}
  - cxl/port: Fix use after free of parent_port in cxl_detach_ep() (Myron Stowe) [RHEL-180691] {CVE-2026-31530}
  - net/mlx5: Fix slab-out-of-bounds in mlx5_query_nic_vport_mac_list (CKI Backport Bot) [RHEL-213036]
  - x86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache (Dennis Chen) [RHEL-188790] {CVE-2025-54518}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.38.1.el9_8]
changelog:
  - cifs: fix time_last_write stamp placement in setattr/truncate paths (Paulo Alcantara) [RHEL-192999]
  - cifs: consolidate time_last_write stamp into _cifsFileInfo_put() (Paulo Alcantara) [RHEL-192999]
  - cifs: fix cifsFileInfo leak on kmalloc failure in deferred close drain paths (Paulo Alcantara) [RHEL-192999]
  - cifs: prevent readdir from changing file size due to stale directory metadata (Paulo Alcantara) [RHEL-192999]
  - smb: client: fix dir separator in SMB1 UNIX mounts (Paulo Alcantara) [RHEL-192999]
  - smb: client: fix sbflags initialization (Paulo Alcantara) [RHEL-192999]
  - smb: client: use atomic_t for mnt_cifs_flags (Paulo Alcantara) [RHEL-192999]
  - mm/slab: do not limit zeroing to orig_size when only red zoning is enabled (Rafael Aquini) [RHEL-223404] {CVE-2026-64368}


