# changelog

author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.9.1.el10_0]
changelog:
  - af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK (Davide Caratti) [RHEL-80306] {CVE-2024-57901}
  - redhat: kabi: update stablelist checksums (Čestmír Kalina) [RHEL-80552]
  - shrinker: include rh_kabi.h (Čestmír Kalina) [RHEL-80552]
  - redhat: pad the folio_batch struct (Nico Pache) [RHEL-80552]
  - redhat: pad the lruvec structure for the kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the zone structures for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the wait_page_queue for the kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the lru_gen functions for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the vmem_altmap struct for the kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the vm_fault structure (Nico Pache) [RHEL-80552]
  - redhat: pad the tlbflush_unmap_batch struct for the KABI (Nico Pache) [RHEL-80552]
  - redhat: pad the swap_cluster_info structure for KABI (Nico Pache) [RHEL-80552]
  - redhat: pad the shrinker struct for KABI (Nico Pache) [RHEL-80552]
  - redhat: pad the shrink_control structure for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the readahead_control structure for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the pglist_data structure for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the percpu structures (Nico Pache) [RHEL-80552]
  - redhat: pad the page_frag_cache for the kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the ns_common structure for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad mmu_notifier functions for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the mm_struct for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad mempool_s structure for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad mempolicy struct for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the memory_failure_stats for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the kmem_cache_args struct (Nico Pache) [RHEL-80552]
  - redhat: pad the kmem_cache structure (Nico Pache) [RHEL-80552]
  - redhat: pad ip_conntrack_stat for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the free_area struct (Nico Pache) [RHEL-80552]
  - redhat: pad follow_pfnmap_args for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad anon_vma for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad access_coordinate for kabi (Nico Pache) [RHEL-80552]
  - redhat: pad the deferred_split queue for the kabi checker (Nico Pache) [RHEL-80552]
  - redhat: hide capture_control from kabi checker (Nico Pache) [RHEL-80552]
  - mm/memcg: Exclude mem_cgroup/obj_cgroup pointer from kABI signature computation (Waiman Long) [RHEL-80552]
  - net: stmmac: dwmac-tegra: Read iommu stream id from device tree (Izabela Bakollari) [RHEL-75653] {CVE-2025-21663}
  - Revert "smb: client: fix chmod(2) regression with ATTR_READONLY" (Jan Stancek)


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.18.1.el10_0]
changelog:
  - Import config changes from Centos Stream kernel kernel-6.12.0-77.el10
  - Bump internal version to 55.18.1
  - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation
  - sched/rt: Fix race in push_rt_task MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit
  - mm/vmalloc: combine all TLB flush operations of KASAN shadow virtual address into one operation - upstream CVE-2024-56559
  - block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone
  - proc: fix UAF in proc_get_inode() CVE-2025-21999
  - ext4: ignore xattrs past end CVE-2025-37738
  - nvme-fabrics: handle zero MAXCMD without closing the connection
  - ext4: fix off-by-one error in do_split CVE-2025-23150
  - r8169: disable RTL8126 ZRX-DC timeout
  - r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support
  - vmxnet3: unregister xdp rxq info in the reset path
  - block: fix 'kmem_cache of name 'bio-108' already exists'
  - ice: implement low latency PHY timer updates
  - ice: check low latency PHY timer update firmware capability
  - ice: add lock to protect low latency interface
  - ice: rename TS_LL_READ* macros to REG_LL_PROXY_H_*
  - ice: use read_poll_timeout_atomic in ice_read_phy_tstamp_ll_e810
  - cifs: Fix integer overflow while processing acdirmax mount option CVE-2025-21963
  - smb: client: fix UAF in decryption with multichannel CVE-2025-37750
  - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug
  - keys: Fix UAF in key_put() CVE-2025-21893
  - ndisc: use RCU protection in ndisc_alloc_skb() CVE-2025-21764
  - ipv6: use RCU protection in ip6_default_advmss() CVE-2025-21765
  - net: add dev_net_rcu() helper CVE-2025-21765
  - vfio/pci: Align huge faults to order
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del CVE-2025-21969
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd CVE-2025-21969
  - cifs: Fix integer overflow while processing closetimeo mount option CVE-2025-21962
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up CVE-2025-21887
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails CVE-2025-21979
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy CVE-2025-21979
  - net: fix geneve_opt length integer overflow CVE-2025-22055
  - vsock/virtio: discard packets if the transport changes CVE-2025-21669
  - net: gso: fix ownership in __udp_gso_segment CVE-2025-21926
  - xsk: fix an integer overflow in xp_create_and_assign_umem() CVE-2025-21997
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi CVE-2025-37943
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list CVE-2025-21919
  - drm/i915/display: Use joined pipes in dsc helpers for slices, bpp - upstream
  - drm/i915/display: Use joined pipes in intel_mode_valid_max_plane_size - upstream
  - drm/i915/display: Use joined pipes in intel_dp_joiner_needs_dsc - upstream
  - drm/i915/display: Simplify intel_joiner_num_pipes and it's usage - upstream
  - drm/i915/display: Check whether platform supports joiner - upstream
  - Revert drm/i915/dp_mst: Handle error during DSC BW overhead/slice
  - Revert drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC
  - drm/mgag200: Added support for the new device G200eH5 - upstream
  - cifs: Fix integer overflow while processing acregmax mount option CVE-2025-21964
  - ext4: fix OOB read when checking dotdot dir CVE-2025-37785
  - vsock: Orphan socket after transport release CVE-2025-21756
  - vsock: Keep the binding until socket destruction CVE-2025-21756
  - bpf, vsock: Invoke proto::close on close() CVE-2025-21756
  - idpf: call set_real_num_queues in idpf_open
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format CVE-2024-53104
  - redhat: enable CONFIG_WERROR=y
  - redhat: don't enforce WERROR for 3rd-party OOT kmods
  - redhat: make ENABLE_WERROR enable also KVM_WERROR
  - fortify: Hide run-time copy size from value range tracking
  - resolve_btfids: Fix compiler warnings
  - ixgbe: fix media cage present detection for E610 device
  - ixgbe: fix media type detection for E610 device
  - ixgbevf: Add support for Intel(R) E610 device
  - PCI: Add PCI_VDEVICE_SUB helper macro
  - ixgbe: Enable link management in E610 device
  - ixgbe: Clean up the E610 link management related code
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection
  - ixgbe: Add support for EEPROM dump in E610 device
  - ixgbe: Add support for NVM handling in E610 device
  - ixgbe: Add link management support for E610 device
  - ixgbe: Add support for E610 device capabilities detection
  - ixgbe: Add support for E610 FW Admin Command Interface
  - smb: client: don't retry IO on failed negprotos with soft mounts - pick from MR
  - scsi: core: Fix command pass through retry regression - cherry pick from MR
  - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature CVE-2025-21966
  - ice: stop storing XDP verdict within ice_rx_buf
  - ice: gather page_count()'s of each frag right before XDP prog call
  - ice: put Rx buffers after being done with current frame
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() CVE-2025-21993
  - smb: client: fix regression with guest option
  - pnfs/flexfiles: retry getting layout segment for reads
  - nfs: fix incorrect error handling in LOCALIO
  - nfs: probe for LOCALIO when v3 client reconnects to server
  - nfs: probe for LOCALIO when v4 client reconnects to server
  - nfs/localio: remove redundant code and simplify LOCALIO enablement
  - nfs_common: add nfs_localio trace events
  - nfs_common: track all open nfsd_files per LOCALIO nfs_client
  - nfs_common: rename nfslocalio nfs_uuid_lock to nfs_uuids_lock
  - nfsd: nfsd_file_acquire_local no longer returns GC'd nfsd_file
  - nfsd: rename nfsd_serv_ prefixed methods and variables with nfsd_net_
  - nfsd: update percpu_ref to manage references on nfsd_net
  - nfs: cache all open LOCALIO nfsd_file(s) in client
  - nfs_common: move localio_lock to new lock member of nfs_uuid_t
  - nfs_common: rename functions that invalidate LOCALIO nfs_clients
  - nfsd: add nfsd_file_{get,put} to 'nfs_to' nfsd_localio_operations
  - nfs/localio: add direct IO enablement with sync and async IO support
  - ice: ensure periodic output start time is in the future
  - ice: fix PHY Clock Recovery availability check
  - ice: Drop auxbus use for PTP to finalize ice_adapter move
  - ice: Use ice_adapter for PTP shared data instead of auxdev
  - ice: Initial support for E825C hardware in ice_adapter
  - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code
  - ice: Introduce ice_get_phy_model() wrapper
  - ice: Enable 1PPS out from CGU for E825C products
  - ice: Read SDP section from NVM for pin definitions
  - ice: Disable shared pin on E810 on setfunc
  - ice: Cache perout/extts requests and check flags
  - ice: Align E810T GPIO to other products
  - ice: Add SDPs support for E825C
  - ice: Implement ice_ptp_pin_desc
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() - modified CVE-2025-21927
  - scsi: storvsc: Set correct data length for sending SCSI command without payload
  - smb: client: fix chmod(2) regression with ATTR_READONLY
  - mm/hugetlb: fix hugepage allocation for interleaved memory nodes
  - net: mana: use ethtool string helpers
  - net: mana: cleanup mana struct after debugfs_remove() - upstream
  - net: mana: Cleanup "mana" debugfs dir after cleanup of all children
  - net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs
  - net: mana: Fix memory leak in mana_gd_setup_irqs
  - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT
  - net: mana: Enable debugfs files for MANA device
  - net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024
  - net: mana: Add get_link and get_link_ksettings in ethtool


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.19.1.el10_0]
changelog:
  - Clean git history at setup stage
  - Prevent kABI check error for BLK_CGROUP_PUNT_BIO
  - Bump internal version to 55.19.1
  - ibmvnic: Use kernel helpers for hex dumps
  - eth: bnxt: fix truesize for mb-xdp-pass case
  - ice: Avoid setting default Rx VSI twice in switchdev setup
  - ice: Fix deinitializing VF in error path
  - ice: add E830 HW VF mailbox message limit support
  - block/Kconfig: Allow selecting BLK_CGROUP_PUNT_BIO


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.19.1.0.1.el10_0.OL10]
changelog:
  - nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
  - Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
  - Disable UKI signing [Orabug: 36571828]
  - Update Oracle Linux certificates (Kevin Lyons)
  - Disable signing for aarch64 (Ilya Okomin)
  - Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Update x509.genkey [Orabug: 24817676]
  - Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
  - Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
  - Add Oracle Linux IMA certificates
  - Update module name for cryptographic module [Orabug: 37400433]


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.20.1.el10_0]
changelog:
  - Bump internal version to 55.20.1
  - Adjust page_pool: Track DMA-mapped pages and unmap them when destroying the pool
  - Adjust dm mpath: Interface for explicit probing of active paths
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes - CVE-2025-21991
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool
  - page_pool: Move pp_magic check into helper functions
  - scsi: storvsc: Explicitly set max_segment_size to UINT_MAX
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp - CVE-2025-37799
  - dm mpath: replace spin_lock_irqsave with spin_lock_irq
  - dm-mpath: Don't grab work_mutex while probing paths
  - dm mpath: Interface for explicit probing of active paths
  - dm: Allow .prepare_ioctl to handle ioctls directly
  - ipv6: mcast: extend RCU protection in igmp6_send() - CVE-2025-21759


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.21.1.el10_0]
changelog:
  - Bump internal version to 55.21.1
  - ice, irdma: fix an off by one in error handling code
  - irdma: free iwdev->rf after removing MSI-X
  - ice: Fix signedness bug in ice_init_interrupt_scheme()
  - ice: init flow director before RDMA
  - ice: simplify VF MSI-X managing
  - ice: enable_rdma devlink param
  - ice: treat dyn_allowed only as suggestion
  - ice, irdma: move interrupts code to irdma
  - ice: get rid of num_lan_msix field
  - ice: remove splitting MSI-X between features
  - ice: devlink PF MSI-X max and min parameter
  - ice: ice_probe: init ice_adapter after HW init
  - ice: minor: rename goto labels from err to unroll
  - ice: split ice_init_hw() out from ice_init_dev()
  - ice: c827: move wait for FW to ice_init_hw()
  - exfat: fix random stack corruption after get_block - CVE-2025-22036


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.22.1.el10_0]
changelog:
  - Bump internal version to 55.22.1
  - mm/huge_memory: fix dereferencing invalid pmd migration entry - CVE-2025-37958
  - i2c: tegra: check msg length in SMBUS block read
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error - CVE-2025-38089
  - media: uvcvideo: Announce the user our deprecation intentions
  - media: uvcvideo: Allow changing noparam on the fly
  - media: uvcvideo: Invert default value for nodrop module param
  - media: uvcvideo: Propagate buf->error to userspace
  - media: uvcvideo: Flush the control cache when we get an event
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set
  - media: uvcvideo: Remove dangling pointers - CVE-2024-58002
  - media: uvcvideo: Remove redundant NULL assignment
  - media: uvcvideo: Only save async fh if success
  - media: uvcvideo: Fix double free in error path - CVE-2024-57980
  - wifi: iwlwifi: limit printed string from FW file - CVE-2025-21905


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.24.1.el10_0]
changelog:
  - Bump internal version to 55.24.1
  - net_sched: hfsc: Fix a UAF vulnerability in class handling - CVE-2025-37797
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() - CVE-2025-22121
  - ext4: introduce ITAIL helper - CVE-2025-22121
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access - CVE-2025-38110
  - powerpc/vas: Return -EINVAL if the offset is non-zero in mmap() - CVE-2025-38088
  - powerpc/powernv/memtrace: Fix out of bounds issue in memtrace mmap - CVE-2025-38088
  - net/mlx5: Fill out devlink dev info only for PFs
  - RDMA/mlx5: Fix page_size variable overflow - CVE-2025-22091
  - ACPI: CPPC: Fix _CPC register setting issue


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.25.1.el10_0]
changelog:
  - Bump internal version to 55.25.1
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice - CVE-2025-38001
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() - CVE-2025-38000
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc - CVE-2025-37890
  - sch_hfsc: make hfsc_qlen_notify() idempotent
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem - CVE-2025-38022
  - RDMA/core: Fix use-after-free when rename device name - CVE-2025-22085
  - nvme-tcp: sanitize request list handling - CVE-2025-38264
  - net: tipc: fix refcount warning in tipc_aead_encrypt
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done - CVE-2025-38052
  - tcp: adjust rcvq_space after updating scaling ratio
  - ext4: avoid journaling sb update on error if journal is destroying - CVE-2025-22113
  - ext4: define ext4_journal_destroy wrapper - CVE-2025-22113
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() - CVE-2025-21928
  - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() - CVE-2025-21929
  - usb: hub: Fix flushing of delayed work used for post resume purposes
  - usb: hub: Fix flushing and scheduling of delayed work that tunes runtime pm
  - usb: hub: fix detection of high tier USB3 devices behind suspended hubs
  - net/sched: fix use-after-free in taprio_dev_notifier - CVE-2025-38087
  - net: ch9200: fix uninitialised access during mii_nway_restart - CVE-2025-38086
  - padata: avoid UAF for reorder_work - CVE-2025-21726
  - padata: fix UAF in padata_reorder - CVE-2025-21727
  - padata: add pd get/put refcnt helper
  - padata: fix sysfs store callback check
  - padata: Clean up in padata_do_multithreaded()
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove -CVE-2025-22020


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.27.1.el10_0]
changelog:
  - Bump internal version to 55.27.1
  - Fix includes for mm: fix copy_vma() error handling for hugetlb mappings
  - Revert sch_htb: make htb_qlen_notify() idempotent
  - Revert sch_drr: make drr_qlen_notify() idempotent
  - Revert sch_qfq: make qfq_qlen_notify() idempotent
  - Revert codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()
  - Revert sch_htb: make htb_deactivate() idempotent
  - Revert net/sched: Always pass notifications when child class becomes empty
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds - CVE-2025-38159
  - Documentation: Fix pci=config_acs= example
  - PCI/ACS: Fix 'pci=config_acs=' parameter
  - Revert "smb: client: fix TCP timers deadlock after rmmod" - CVE-2025-22077
  - Revert smb: client: Fix netns refcount imbalance causing leaks and use-after-free 
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free
  - wifi: ath12k: fix invalid access to memory - CVE-2025-38292
  - x86/CPU/AMD: Terminate the erratum_1386_microcode array - CVE-2024-56721
  - crypto: algif_hash - fix double free in hash_accept - CVE-2025-38079
  - net/sched: Always pass notifications when child class becomes empty - CVE-2025-38350
  - sch_htb: make htb_deactivate() idempotent - CVE-2025-38350
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() - CVE-2025-38350
  - sch_qfq: make qfq_qlen_notify() idempotent - CVE-2025-38350
  - sch_drr: make drr_qlen_notify() idempotent - CVE-2025-38350
  - sch_htb: make htb_qlen_notify() idempotent - CVE-2025-38350
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race - CVE-2025-38085
  - mm/hugetlb: unshare page tables during VMA split, not before - CVE-2025-38084
  - tools/testing/vma: add missing function stub
  - mm: fix copy_vma() error handling for hugetlb mappings
  - PCI: Use downstream bridges for distributing resources
  - PCI/pwrctrl: Cancel outstanding rescan work when unregistering - CVE-2025-38137
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.28.1.el10_0]
changelog:
  - Conflict with xdp-tools < 1.5.4
  - Bump internal version to 55.28.1
  - tls: always refresh the queue when reading sock - CVE-2025-38471
  - selftests: net: bpf_offload: add 'libbpf_global' to ignored maps
  - selftests: net: fix error message in bpf_offload
  - selftests: net: add more info to error in bpf_offload
  - net: fix udp gso skb_segment after pull from frag_list - CVE-2025-38124
  - powerpc/pseries/vas: Add close() callback in vas_vm_ops struct
  - s390/pci: Serialize device addition and removal
  - s390/pci: Allow re-add of a reserved but not yet removed device
  - s390/pci: Prevent self deletion in disable_slot()
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device()
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs
  - s390/pci: Fix missing check for zpci_create_device() error return
  - s390/pci: Fix potential double remove of hotplug slot
  - s390/topology: Improve topology detection
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() - CVE-2025-38250
  - selftests/bpf: Adjust data size to have ETH_HLEN - CVE-2025-21867
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() - CVE-2025-21867
  - i2c/designware: Fix an initialization issue - CVE-2025-38380


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.29.1.el10_0]
changelog:
  - Bump internal version to 55.29.1
  - ice: fix eswitch code memory leak in reset scenario - CVE-2025-38417
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist
  - net_sched: ets: Fix double list add in class with netem as child qdisc - CVE-2025-37914
  - sch_ets: make est_qlen_notify() idempotent
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw - CVE-2025-38200
  - cxgb4: use port number to set mac addr


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.30.1.el10_0]
changelog:
  - tipc: Fix use-after-free in tipc_conn_close(). - CVE-2025-38464
  - Bump internal version to 55.30.1
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too - CVE-2025-37823
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs
  - s390/pci: Fix handling of isolated VFs
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn()
  - s390/pci: Fix SR-IOV for PFs initially in standby
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction - CVE-2025-38211
  - udp: Fix memory accounting leak. - CVE-2025-22058
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc.
  - ext4: only dirty folios when data journaling regular files - CVE-2025-38220
  - vsock: Fix transport_* TOCTOU - CVE-2025-38461
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry - CVE-2025-38472


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.31.1.el10_0]
changelog:
  - Adjust sched/fair: Adhere to place_entity() constraints
  - Bump internal version to 55.31.1
  - sched/fair: Adhere to place_entity() constraints
  - sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag
  - sched/fair: optimize the PLACE_LAG when se->vlag is zero
  - net/sched: ets: use old 'nbands' while purging unused classes - CVE-2025-38350
  - net/sched: Always pass notifications when child class becomes empty - CVE-2025-38350
  - net_sched: ets: fix a race in ets_qdisc_change() - CVE-2025-38107
  - sch_htb: make htb_deactivate() idempotent - CVE-2025-37953
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() - CVE-2025-37798
  - sch_qfq: make qfq_qlen_notify() idempotent - CVE-2025-38350
  - sch_drr: make drr_qlen_notify() idempotent - CVE-2025-38350
  - sch_htb: make htb_qlen_notify() idempotent - CVE-2025-37932
  - drm/vkms: Fix use after free and double free on init error - CVE-2025-22097
  - Revert "cxl/acpi: Fix load failures due to single window creation failure"
  - udmabuf: fix a buf size overflow issue during udmabuf creation - CVE-2025-37803
  - drm/framebuffer: Acquire internal references on GEM handles - CVE-2025-38449
  - drm/gem: Acquire references on GEM handles for framebuffers - CVE-2025-38449
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer
  - nvme-ioctl: fix leaked requests on mapping error


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.32.1.el10_0]
changelog:
  - Bump internal version to 55.32.1
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() - CVE-2025-38352


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.33.1.el10_0]
changelog:
  - Fix kABI for net_namespace.h
  - Bump internal version to 55.33.1
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface - CVE-2025-38500
  - idpf: convert control queue mutex to a spinlock - CVE-2025-38392
  - eth: bnxt: fix missing ring index trim on error path - CVE-2025-37873
  - tcp: Correct signedness in skb remaining space calculation - CVE-2025-38463
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() - CVE-2025-38550
  - redhat: selftests/bpf: Add cpuv4 variant
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards - CVE-2025-38200
  - use uniform permission checks for all mount propagation changes - CVE-2025-38498
  - do_change_type(): refuse to operate on unmounted/not ours mounts - CVE-2025-38498
  - ublk: make sure ubq->canceling is set when queue is frozen - CVE-2025-22068
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM
  - scsi: lpfc: Use memcpy() for BIOS version - CVE-2025-38332
  - net: introduce per netns packet chains


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.34.1.el10_0]
changelog:
  - Bump internal version to 55.34.1
  - sunrpc: fix handling of server side tls alerts - CVE-2025-38566
  - i40e: When removing VF MAC filters, only check PF-set MAC
  - usb: dwc3: gadget: check that event count does not exceed event buffer length - CVE-2025-37810


author: Alex Burmashev <alexander.burmashev@oracle.com> [6.12.0-55.37.1.el10_0]
changelog:
  - fix kABI build errors
  - Adjust new tls selftest for current code
  - Bump internal version to 55.37.1
  - selftests: tls: add tests for zero-length records - CVE-2025-39682
  - tls: fix handling of zero-length records on the rx_list - CVE-2025-39682
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass - CVE-2025-38396
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure - CVE-2025-39698
  - ice: use fixed adapter index for E825C embedded devices
  - ice: use DSN instead of PCI BDF for ice_adapter index
  - tcp: drop secpath at the same time as we currently drop dst
  - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code
  - cifs: Fix the smbd_response slab to allow usercopy - CVE-2025-38523
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data
  - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma()
  - smb: client: make use of common smbdirect_socket_parameters
  - smb: smbdirect: introduce smbdirect_socket_parameters
  - smb: client: make use of common smbdirect_socket
  - smb: smbdirect: add smbdirect_socket.h
  - smb: client: make use of common smbdirect.h
  - smb: smbdirect: add smbdirect.h with public structures
  - smb: client: make use of common smbdirect_pdu.h
  - smb: smbdirect: add smbdirect_pdu.h with protocol definitions
  - s390/sclp: Fix SCCB present check - CVE-2025-39694
  - net: stmmac: fix TSO DMA API usage causing oops
  - smb: client: fix use-after-free in cifs_oplock_break - CVE-2025-38527


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.30.1.el10_0]
changelog:
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-107641] {CVE-2025-37823}
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-95537]
  - s390/pci: Fix handling of isolated VFs (CKI Backport Bot) [RHEL-84462]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (CKI Backport Bot) [RHEL-84462]
  - s390/pci: Fix SR-IOV for PFs initially in standby (CKI Backport Bot) [RHEL-84462]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CKI Backport Bot) [RHEL-104285] {CVE-2025-38211}
  - udp: Fix memory accounting leak. (CKI Backport Bot) [RHEL-104102] {CVE-2025-22058}
  - udp: Fix multiple wraparounds of sk->sk_rmem_alloc. (Xin Long) [RHEL-104102]
  - ext4: only dirty folios when data journaling regular files (CKI Backport Bot) [RHEL-106815] {CVE-2025-38220}
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106660] {CVE-2025-38464}
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-106015] {CVE-2025-38461}
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CKI Backport Bot) [RHEL-106442] {CVE-2025-38472}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.31.1.el10_0]
changelog:
  - sched/fair: Adhere to place_entity() constraints (Phil Auld) [RHEL-91404]
  - sched/fair: Fix update_cfs_group() vs DELAY_DEQUEUE (Phil Auld) [RHEL-91404]
  - sched/fair: Fix EEVDF entity placement bug causing scheduling lag (Phil Auld) [RHEL-91404]
  - sched/fair: optimize the PLACE_LAG when se->vlag is zero (Phil Auld) [RHEL-91404]
  - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107544] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107544] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93365] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93365] {CVE-2025-37932}
  - drm/vkms: Fix use after free and double free on init error (Jocelyn Falempe) [RHEL-99432] {CVE-2025-22097}
  - Revert "cxl/acpi: Fix load failures due to single window creation failure" (John W. Linville) [RHEL-85055]
  - udmabuf: fix a buf size overflow issue during udmabuf creation (Lyude Paul) [RHEL-99760] {CVE-2025-37803}
  - drm/framebuffer: Acquire internal references on GEM handles (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (Mika Penttilä) [RHEL-106710] {CVE-2025-38449}
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Maurizio Lombardi) [RHEL-109753]
  - nvme-ioctl: fix leaked requests on mapping error (Maurizio Lombardi) [RHEL-109753]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.32.1.el10_0]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112784] {CVE-2025-38352}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.33.1.el10_0]
changelog:
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot) [RHEL-109530] {CVE-2025-38500}
  - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106061] {CVE-2025-38392}
  - eth: bnxt: fix missing ring index trim on error path (CKI Backport Bot) [RHEL-104564] {CVE-2025-37873}
  - tcp: Correct signedness in skb remaining space calculation (CKI Backport Bot) [RHEL-107844] {CVE-2025-38463}
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CKI Backport Bot) [RHEL-111154] {CVE-2025-38550}
  - redhat: selftests/bpf: Add cpuv4 variant (Viktor Malik) [RHEL-109928]
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen) [RHEL-105138] {CVE-2025-38200}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107306] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107306] {CVE-2025-38498}
  - ublk: make sure ubq->canceling is set when queue is frozen (Ming Lei) [RHEL-99437] {CVE-2025-22068}
  - net: gso: Forbid IPv6 TSO with extensions on devices with only IPV6_CSUM JIRA: https://issues.redhat.com/browse/RHEL-109821 Y-JIRA: https://issues.redhat.com/browse/RHEL-79173 (Jakub Ramaseuski)
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105936] {CVE-2025-38332}
  - net: introduce per netns packet chains (Paolo Abeni) [RHEL-88923]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.34.1.el10_0]
changelog:
  - sunrpc: fix handling of server side tls alerts (Olga Kornievskaia) [RHEL-111073] {CVE-2025-38566}
  - i40e: When removing VF MAC filters, only check PF-set MAC (CKI Backport Bot) [RHEL-109771]
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (CKI Backport Bot) [RHEL-107659] {CVE-2025-37810}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.35.1.el10_0]
changelog:
  - cifs: Fix reading into an ITER_FOLIOQ from the smbdirect code (Paulo Alcantara) [RHEL-111177]
  - cifs: Fix the smbd_response slab to allow usercopy (Paulo Alcantara) [RHEL-111177] {CVE-2025-38523}
  - smb: client: let smbd_post_send_iter() respect the peers max_send_size and transmit all data (Paulo Alcantara) [RHEL-111177]
  - smb: client: fix max_sge overflow in smb_extract_folioq_to_rdma() (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_socket_parameters (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: introduce smbdirect_socket_parameters (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_socket (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect_socket.h (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect.h (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect.h with public structures (Paulo Alcantara) [RHEL-111177]
  - smb: client: make use of common smbdirect_pdu.h (Paulo Alcantara) [RHEL-111177]
  - smb: smbdirect: add smbdirect_pdu.h with protocol definitions (Paulo Alcantara) [RHEL-111177]
  - s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113561] {CVE-2025-39694}
  - net: stmmac: fix TSO DMA API usage causing oops (Izabela Bakollari) [RHEL-105352]
  - smb: client: fix use-after-free in cifs_oplock_break (CKI Backport Bot) [RHEL-111198] {CVE-2025-38527}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.36.1.el10_0]
changelog:
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114341] {CVE-2025-39698}
  - ice: use fixed adapter index for E825C embedded devices (CKI Backport Bot) [RHEL-111792]
  - ice: use DSN instead of PCI BDF for ice_adapter index (CKI Backport Bot) [RHEL-111792]
  - tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-82133]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.37.1.el10_0]
changelog:
  - selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114331] {CVE-2025-39682}
  - tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114331] {CVE-2025-39682}
  - fs: export anon_inode_make_secure_inode() and fix secretmem LSM bypass (Audra Mitchell) [RHEL-110313] {CVE-2025-38396}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.38.1.el10_0]
changelog:
  - hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-114930]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-114930]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-114930]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-114930]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Maxim Levitsky) [RHEL-114930]
  - net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add support for Multi Vports on Bare metal (Maxim Levitsky) [RHEL-114930]
  - net: mana: Switch to page pool for jumbo frames (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add metadata support for xdp mode (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (Maxim Levitsky) [RHEL-114930]
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Ensure variable err is initialized (Maxim Levitsky) [RHEL-114930]
  - net: mana: Add debug logs in MANA network driver (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Maxim Levitsky) [RHEL-114930]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: request error CQEs when supported (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Query feature_flags bitmask from FW (Maxim Levitsky) [RHEL-114930]
  - net: mana: Support holes in device list reply msg (Maxim Levitsky) [RHEL-114930]
  - RDMA/mana_ib: Allocate PAGE aligned doorbell index (Maxim Levitsky) [RHEL-114930]
  - hv_netvsc: Link queues to NAPIs (Maxim Levitsky) [RHEL-114930]
  - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113339] {CVE-2025-38718}
  - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-93626] {CVE-2025-22026}
  - smb: client: fix session setup against servers that require SPN (Paulo Alcantara) [RHEL-107110]
  - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-107110]
  - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event (CKI Backport Bot) [RHEL-100817]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.39.1.el10_0]
changelog:
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114712] {CVE-2025-39761}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CKI Backport Bot) [RHEL-114695] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (CKI Backport Bot) [RHEL-114695]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114695] {CVE-2025-39757}
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111037] {CVE-2025-38556}
  - cxl: core/region - ignore interleave granularity when ways=1 (John W. Linville) [RHEL-107595]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.40.1.el10_0]
changelog:
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119125] {CVE-2025-39841}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118460] {CVE-2025-39817}
  - ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-116192]
  - net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-116192]
  - SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110813]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110813] {CVE-2025-38571}
  - s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114447]
  - s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114447]
  - s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114430]
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114430]
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114438]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114438]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114438]
  - ipv6: reject malicious packets in ipv6_gso_segment() (CKI Backport Bot) [RHEL-113248] {CVE-2025-38572}
  - enic: fix incorrect MTU comparison in enic_change_mtu() (John Meneghini) [RHEL-108265]
  - net/enic: Allow at least 8 RQs to always be used (John Meneghini) [RHEL-108265]
  - enic: get max rq & wq entries supported by hw, 16K queues (John Meneghini) [RHEL-106602]
  - enic: cleanup of enic wq request completion path (John Meneghini) [RHEL-106602]
  - enic: added enic_wq.c and enic_wq.h (John Meneghini) [RHEL-106602]
  - enic: remove unused function cq_enet_wq_desc_dec (John Meneghini) [RHEL-106602]
  - enic: enable rq extended cq support (John Meneghini) [RHEL-106602]
  - enic: enic rq extended cq defines (John Meneghini) [RHEL-106602]
  - enic: enic rq code reorg (John Meneghini) [RHEL-106602]
  - enic: Move function from header file to c file (John Meneghini) [RHEL-106602]
  - enic: add dependency on Page Pool (John Meneghini) [RHEL-106602]
  - enic: remove copybreak tunable (John Meneghini) [RHEL-106602]
  - enic: Use the Page Pool API for RX (John Meneghini) [RHEL-106602]
  - enic: Simplify RX handler function (John Meneghini) [RHEL-106602]
  - enic: Move RX functions to their own file (John Meneghini) [RHEL-106602]
  - enic: Fix typo in comment in table indexed by link speed (John Meneghini) [RHEL-106602]
  - enic: Obtain the Link speed only after the link comes up (John Meneghini) [RHEL-106602]
  - enic: Move RX coalescing set function (John Meneghini) [RHEL-106602]
  - enic: Move kdump check into enic_adjust_resources() (John Meneghini) [RHEL-106602]
  - enic: Move enic resource adjustments to separate function (John Meneghini) [RHEL-106602]
  - enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (John Meneghini) [RHEL-106602]
  - enic: Allocate arrays in enic struct based on VIC config (John Meneghini) [RHEL-106602]
  - enic: Save resource counts we read from HW (John Meneghini) [RHEL-106602]
  - enic: Make MSI-X I/O interrupts come after the other required ones (John Meneghini) [RHEL-106602]
  - enic: Create enic_wq/rq structures to bundle per wq/rq data (John Meneghini) [RHEL-106602]
  - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (John Meneghini) [RHEL-111542]
  - scsi: fnic: Set appropriate logging level for log message (John Meneghini) [RHEL-111542]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (John Meneghini) [RHEL-111542]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (John Meneghini) [RHEL-111542]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (John Meneghini) [RHEL-111542]
  - scsi: fnic: Remove unnecessary spinlock locking and unlocking (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace fnic->lock_flags with local flags (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace use of sizeof with standard usage (John Meneghini) [RHEL-111539]
  - scsi: fnic: Fix indentation and remove unnecessary parenthesis (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary debug print (John Meneghini) [RHEL-111539]
  - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (John Meneghini) [RHEL-111539]
  - scsi: fnic: Test for memory allocation failure and return error code (John Meneghini) [RHEL-111539]
  - scsi: fnic: Return appropriate error code from failure of scsi drv init (John Meneghini) [RHEL-111539]
  - scsi: fnic: Return appropriate error code for mem alloc failure (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (John Meneghini) [RHEL-111539]
  - scsi: fnic: Fix use of uninitialized value in debug message (John Meneghini) [RHEL-111539]
  - scsi: fnic: Delete incorrect debugfs error handling (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove extern definition from .c files (John Meneghini) [RHEL-111539]
  - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support to handle port channel RSCN (John Meneghini) [RHEL-111539]
  - scsi: fnic: Code cleanup (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add stats and related functionality (John Meneghini) [RHEL-111539]
  - scsi: fnic: Modify fnic interfaces to use FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Modify IO path to use FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add functionality in fnic to support FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add and integrate support for FIP (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add and integrate support for FDMI (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add Cisco hardware model names (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for unsolicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for target based solicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add support for fabric based solicited requests and responses (John Meneghini) [RHEL-111539]
  - scsi: fnic: Add headers and definitions for FDLS (John Meneghini) [RHEL-111539]
  - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (John Meneghini) [RHEL-111539]
  - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111056] {CVE-2025-38614}
  - mm/memory-tier: fix abstract distance calculation overflow (Rafael Aquini) [RHEL-109447]
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (CKI Backport Bot) [RHEL-104737] {CVE-2025-38351}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.41.1.el10_0]
changelog:
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114853] {CVE-2025-39751}
  - erofs: fix blksize < PAGE_SIZE for file-backed mounts (CKI Backport Bot) [RHEL-83885] {CVE-2024-56750}
  - s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114499]
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113614] {CVE-2025-39730}
  - net/mlx5: Generate PPS IN event on new function for shared clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Support one PTP device per hardware clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add devcom component for the clock shared by functions (Michal Schmidt) [RHEL-101997]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Michal Schmidt) [RHEL-101997]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add init and destruction functions for a single HW clock (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Change parameters for PTP internal functions (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add helper functions for PTP callbacks (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: Add support for MRTCQ register (Benjamin Poirier) [RHEL-101997]
  - net/mlx5: use do_aux_work for PHC overflow checks (Michal Schmidt) [RHEL-101997]
  - mlx5_en: use read sequence for gettimex64 (Benjamin Poirier) [RHEL-101997]
  - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113859] {CVE-2025-39697}
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114304] {CVE-2025-39718}
  - mm: swap: fix potential buffer overflow in setup_clusters() (CKI Backport Bot) [RHEL-114863] {CVE-2025-39727}
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117583] {CVE-2025-39849}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-55.42.1.el10_0]
changelog:
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (CKI Backport Bot) [RHEL-123288]
  - KVM: arm64: Disable MPAM visibility by default and ignore VMM writes (Gavin Shan) [RHEL-121690]
  - KVM: arm64: Add a macro for creating filtered sys_reg_descs entries (Gavin Shan) [RHEL-121690]
  - redhat: rpminspect: update emptyrpm list for kernel variants (Alexandra Hájková)
  - cgroup/psi: Set of->priv to NULL upon file release (CKI Backport Bot) [RHEL-119147] {CVE-2025-39881}
  - kernfs: Fix UAF in polling when open file is released (CKI Backport Bot) [RHEL-119147] {CVE-2025-39881}
  - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116388] {CVE-2025-39702}


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.43.1.el10_0]
changelog:
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122878] {CVE-2025-39864}
  - igc: fix lock order in igc_ptp_reset (CKI Backport Bot) [RHEL-118667]
  - igc: add lock preventing multiple simultaneous PTM transactions (CKI Backport Bot) [RHEL-118667]
  - igc: cleanup PTP module if probe fails (CKI Backport Bot) [RHEL-118667]
  - igc: handle the IGC_PTP_ENABLED flag correctly (CKI Backport Bot) [RHEL-118667]
  - igc: move ktime snapshot into PTM retry loop (CKI Backport Bot) [RHEL-118667]
  - igc: increase wait time before retrying PTM (CKI Backport Bot) [RHEL-118667]
  - igc: fix PTM cycle trigger logic (CKI Backport Bot) [RHEL-118667]
  - coredump: Only sort VMAs when core_sort_vma sysctl is set (Herton R. Krzesinski) [RHEL-113363]
  - cxgb4: Avoid removal of uninserted tid (CKI Backport Bot) [RHEL-112148]
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Mamatha Inamdar) [RHEL-103014]
  - tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
  - Revert "mm/execmem: Unify early execmem_cache behaviour" (Waiman Long) [RHEL-92175]
  - x86/Kconfig: only enable ROX cache in execmem when STRICT_MODULE_RWX is set (Waiman Long) [RHEL-92175]
  - x86/mm/pat: don't collapse pages without PSE set (Waiman Long) [RHEL-92175]
  - tools arch x86: Sync the msr-index.h copy with the kernel sources (Waiman Long) [RHEL-92175]
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-92175]
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-92175] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-92175] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-92175]
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-92175]
  - arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-92175]
  - selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - mm/execmem: Unify early execmem_cache behaviour (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-92175]
  - x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-92175] {CVE-2024-28956}
  - KVM: SVM: Set/clear SRSO's BP_SPEC_REDUCE on 0 <=> 1 VM count transitions (Waiman Long) [RHEL-92175]
  - x86/bugs: Add RSB mitigation document (Waiman Long) [RHEL-92175]
  - x86/bugs: Don't fill RSB on context switch with eIBRS (Waiman Long) [RHEL-92175]
  - x86/bugs: Don't fill RSB on VMEXIT with eIBRS+retpoline (Waiman Long) [RHEL-92175]
  - x86/bugs: Fix RSB clearing in indirect_branch_prediction_barrier() (Waiman Long) [RHEL-92175]
  - x86/bugs: Use SBPB in write_ibpb() if applicable (Waiman Long) [RHEL-92175]
  - x86/bugs: Rename entry_ibpb() to write_ibpb() (Waiman Long) [RHEL-92175]
  - x86/bugs: Make spectre user default depend on MITIGATION_SPECTRE_V2 (Waiman Long) [RHEL-92175]
  - x86/bugs: Use the cpu_smt_possible() helper instead of open-coded code (Waiman Long) [RHEL-92175]
  - x86/bugs: Add AUTO mitigations for mds/taa/mmio/rfds (Waiman Long) [RHEL-92175]
  - x86/bugs: Relocate mds/taa/mmio/rfds defines (Waiman Long) [RHEL-92175]
  - x86/bugs: Add X86_BUG_SPECTRE_V2_USER (Waiman Long) [RHEL-92175]
  - x86/bugs: Remove X86_FEATURE_USE_IBPB (Waiman Long) [RHEL-92175]
  - KVM: nVMX: Always use IBPB to properly virtualize IBRS (Waiman Long) [RHEL-92175]
  - x86/bugs: Use a static branch to guard IBPB on vCPU switch (Waiman Long) [RHEL-92175]
  - x86/bugs: Remove the X86_FEATURE_USE_IBPB check in ib_prctl_set() (Waiman Long) [RHEL-92175]
  - x86/mm: Remove X86_FEATURE_USE_IBPB checks in cond_mitigation() (Waiman Long) [RHEL-92175]
  - x86/bugs: Move the X86_FEATURE_USE_IBPB check into callers (Waiman Long) [RHEL-92175]
  - x86/bugs: KVM: Add support for SRSO_MSR_FIX (Waiman Long) [RHEL-92175]
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-92175]
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-92175]
  - x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-92175]
  - x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-92175]
  - x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-92175]
  - x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-92175]
  - x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-92175]
  - module: don't annotate ROX memory as kmemleak_not_leak() (Waiman Long) [RHEL-92175]
  - module: drop unused module_writable_address() (Waiman Long) [RHEL-92175]
  - Revert "x86/module: prepare module loading for ROX allocations of text" (Waiman Long) [RHEL-92175]
  - module: switch to execmem API for remapping as RW and restoring ROX (Waiman Long) [RHEL-92175]
  - execmem: add API for temporal remapping as RW and restoring ROX afterwards (Waiman Long) [RHEL-92175]
  - execmem: don't remove ROX cache from the direct map (Waiman Long) [RHEL-92175]
  - x86/mm/pat: restore large ROX pages after fragmentation (Waiman Long) [RHEL-92175]
  - x86/mm/pat: drop duplicate variable in cpa_flush() (Waiman Long) [RHEL-92175]
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Waiman Long) [RHEL-92175]
  - x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit (Waiman Long) [RHEL-92175]
  - x86/cpu: Fix typo in x86_match_cpu()'s doc (Waiman Long) [RHEL-92175]
  - x86/cpu: Expose only stepping min/max interface (Waiman Long) [RHEL-92175]
  - x86/cpu: Introduce new microcode matching helper (Waiman Long) [RHEL-92175]
  - KVM: x86: Advertise SRSO_USER_KERNEL_NO to userspace (Waiman Long) [RHEL-92175]
  - x86/bugs: Add SRSO_USER_KERNEL_NO support (Waiman Long) [RHEL-92175]
  - module: fix writing of livepatch relocations in ROX text (Waiman Long) [RHEL-92175]
  - x86/execmem: fix ROX cache usage in Xen PV guests (Waiman Long) [RHEL-92175]
  - alloc_tag: load module tags into separate contiguous memory (Waiman Long) [RHEL-92175]
  - alloc_tag: introduce shutdown_mem_profiling helper function (Waiman Long) [RHEL-92175]
  - maple_tree: add mas_for_each_rev() helper (Waiman Long) [RHEL-92175]
  - x86/module: enable ROX caches for module text on 64 bit (Waiman Long) [RHEL-92175]
  - execmem: add support for cache of large ROX pages (Waiman Long) [RHEL-92175]
  - x86/module: prepare module loading for ROX allocations of text (Waiman Long) [RHEL-92175]
  - arch: introduce set_direct_map_valid_noflush() (Waiman Long) [RHEL-92175]
  - module: prepare to handle ROX allocations for text (Waiman Long) [RHEL-92175]
  - asm-generic: introduce text-patching.h (Waiman Long) [RHEL-92175]
  - mm: vmalloc: don't account for number of nodes for HUGE_VMAP allocations (Waiman Long) [RHEL-92175]
  - mm: vmalloc: group declarations depending on CONFIG_MMU together (Waiman Long) [RHEL-92175]
  - x86/cpu: Add CPU type to struct cpuinfo_topology (Waiman Long) [RHEL-92175]
  - x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES (Waiman Long) [RHEL-92175]
  - ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116542]
  - ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-116534]
  - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-116534]
  - ice: default to TIME_REF instead of TXCO on E825-C (Petr Oros) [RHEL-107466]
  - ice: move TSPLL init calls to ice_ptp.c (Petr Oros) [RHEL-107466]
  - ice: fall back to TCXO on TSPLL lock fail (Petr Oros) [RHEL-107466]
  - ice: wait before enabling TSPLL (Petr Oros) [RHEL-107466]
  - ice: add multiple TSPLL helpers (Petr Oros) [RHEL-107466]
  - ice: use bitfields instead of unions for CGU regs (Petr Oros) [RHEL-107466]
  - ice: read TSPLL registers again before reporting status (Petr Oros) [RHEL-107466]
  - ice: clear time_sync_en field for E825-C during reprogramming (Petr Oros) [RHEL-107466]
  - ice: add TSPLL log config helper (Petr Oros) [RHEL-107466]
  - ice: use designated initializers for TSPLL consts (Petr Oros) [RHEL-107466]
  - ice: remove ice_tspll_params_e825 definitions (Petr Oros) [RHEL-107466]
  - ice: fix E825-C TSPLL register definitions (Petr Oros) [RHEL-107466]
  - ice: rename TSPLL and CGU functions and definitions (Petr Oros) [RHEL-107466]
  - ice: move TSPLL functions to a separate file (Petr Oros) [RHEL-107466]
  - ice: enable timesync operation on 2xNAC E825 devices (Petr Oros) [RHEL-107466]
  - ice: refactor ice_sbq_msg_dev enum (Petr Oros) [RHEL-107466]
  - ice: remove SW side band access workaround for E825 (Petr Oros) [RHEL-107466]
  - ice/ptp: fix crosstimestamp reporting (Petr Oros) [RHEL-115351]
  - ice: fix rebuilding the Tx scheduler tree for large queue counts (Petr Oros) [RHEL-115351]
  - ice: create new Tx scheduler nodes for new queues only (Petr Oros) [RHEL-115351]
  - ice: fix Tx scheduler error handling in XDP callback (Petr Oros) [RHEL-115351]
  - ice: Fix LACP bonds without SRIOV environment (Petr Oros) [RHEL-115351]
  - ice: fix vf->num_mac count with port representors (Petr Oros) [RHEL-115351]
  - ice: Check VF VSI Pointer Value in ice_vc_add_fdir_fltr() (Petr Oros) [RHEL-115351]
  - ice: fix Get Tx Topology AQ command error on E830 (Petr Oros) [RHEL-115351]
  - ice: fix using untrusted value of pkt_len in ice_vc_fdir_parse_raw() (Petr Oros) [RHEL-115351]
  - ice: fix input validation for virtchnl BW (Petr Oros) [RHEL-115351]
  - ice: validate queue quanta parameters to prevent OOB access (Petr Oros) [RHEL-115351]
  - ice: stop truncating queue ids when checking (Petr Oros) [RHEL-115351]
  - virtchnl: make proto and filter action count unsigned (Petr Oros) [RHEL-115351]
  - ice: fix reservation of resources for RDMA when disabled (Petr Oros) [RHEL-115351]
  - ice: health.c: fix compilation on gcc 7.5 (Petr Oros) [RHEL-115351]
  - ice: E825C PHY register cleanup (Petr Oros) [RHEL-115351]
  - ice: Refactor E825C PHY registers info struct (Petr Oros) [RHEL-115351]
  - ice: rename ice_ptp_init_phc_eth56g function (Petr Oros) [RHEL-115351]
  - ice: Add E830 checksum offload support (Petr Oros) [RHEL-115351]
  - ice: register devlink prior to creating health reporters (Petr Oros) [RHEL-115351]
  - ice: Fix switchdev slow-path in LAG (Petr Oros) [RHEL-115351]
  - ice: fix memory leak in aRFS after reset (Petr Oros) [RHEL-115351]
  - ice: do not configure destination override for switchdev (Petr Oros) [RHEL-115351]
  - ice: dpll: Remove newline at the end of a netlink error message (Petr Oros) [RHEL-115351]
  - virtchnl: add enumeration for the rxdid format (Petr Oros) [RHEL-115351]
  - ice: support Rx timestamp on flex descriptor (Petr Oros) [RHEL-115351]
  - virtchnl: add support for enabling PTP on iAVF (Petr Oros) [RHEL-115351]
  - ice: refactor ice_fdir_create_dflt_rules() function (Petr Oros) [RHEL-115351]
  - ice: Implement PTP support for E830 devices (Petr Oros) [RHEL-115351]
  - ice: Refactor ice_ptp_init_tx_* (Petr Oros) [RHEL-115351]
  - ice: Add unified ice_capture_crosststamp (Petr Oros) [RHEL-115351]
  - ice: Process TSYN IRQ in a separate function (Petr Oros) [RHEL-115351]
  - ice: Use FIELD_PREP for timestamp values (Petr Oros) [RHEL-115351]
  - ice: Remove unnecessary ice_is_e8xx() functions (Petr Oros) [RHEL-115351]
  - ice: Don't check device type when checking GNSS presence (Petr Oros) [RHEL-115351]
  - ice: use generic unrolled_count() macro (Petr Oros) [RHEL-115351]
  - ice: count combined queues using Rx/Tx count (Petr Oros) [RHEL-115351]
  - ice: Add check for devm_kzalloc() (Petr Oros) [RHEL-115351]
  - ice: remove invalid parameter of equalizer (Petr Oros) [RHEL-115351]
  - ice: fix ice_parser_rt::bst_key array size (Petr Oros) [RHEL-115351]
  - ice: Add in/out PTP pin delays (Petr Oros) [RHEL-115351]
  - ice: use string choice helpers (Petr Oros) [RHEL-115351]
  - ice: add fw and port health reporters (Petr Oros) [RHEL-115351]
  - ice: add recipe priority check in search (Petr Oros) [RHEL-115351]
  - ice: Add MDD logging via devlink health (Petr Oros) [RHEL-115351]
  - ice: add Tx hang devlink health reporter (Petr Oros) [RHEL-115351]
  - ice: rename devlink_port.[ch] to port.[ch] (Petr Oros) [RHEL-115351]
  - ice: cleanup Rx queue context programming functions (Petr Oros) [RHEL-115351]
  - ice: move prefetch enable to ice_setup_rx_ctx (Petr Oros) [RHEL-115351]
  - ice: reduce size of queue context fields (Petr Oros) [RHEL-115351]
  - ice: use <linux/packing.h> for Tx and Rx queue context data (Petr Oros) [RHEL-115351]
  - ice: use structures to keep track of queue context size (Petr Oros) [RHEL-115351]
  - ice: remove int_q_state from ice_tlan_ctx (Petr Oros) [RHEL-115351]
  - ice: fix incorrect PHY settings for 100 GB/s (Petr Oros) [RHEL-115351]
  - ice: fix max values for dpll pin phase adjust (Petr Oros) [RHEL-115351]
  - ice: Fix VLAN pruning in switchdev mode (Petr Oros) [RHEL-115351]
  - ice: Fix NULL pointer dereference in switchdev (Petr Oros) [RHEL-115351]
  - ice: fix PHY timestamp extraction for ETH56G (Petr Oros) [RHEL-115351]
  - ice: Unbind the workqueue (Petr Oros) [RHEL-115351]
  - ice: use stack variable for virtchnl_supported_rxdids (Petr Oros) [RHEL-115351]
  - ice: initialize pf->supported_rxdids immediately after loading DDP (Petr Oros) [RHEL-115351]
  - ice: only allow Tx promiscuous for multicast (Petr Oros) [RHEL-115351]
  - ice: support optional flags in signature segment header (Petr Oros) [RHEL-115351]
  - ice: refactor "last" segment of DDP pkg (Petr Oros) [RHEL-115351]
  - ice: extend dump serdes equalizer values feature (Petr Oros) [RHEL-115351]
  - ice: rework of dump serdes equalizer values feature (Petr Oros) [RHEL-115351]
  - ice: Support VF queue rate limit and quanta size configuration (Petr Oros) [RHEL-115351]
  - virtchnl: fix m68k build. (Petr Oros) [RHEL-115351]
  - virtchnl: support queue rate limit and quanta size configuration (Petr Oros) [RHEL-115351]
  - ice: Cleanup unused declarations (Petr Oros) [RHEL-115351]
  - ice: Use common error handling code in two functions (Petr Oros) [RHEL-115351]
  - ice: Make use of assign_bit() API (Petr Oros) [RHEL-115351]
  - ice: store max_frame and rx_buf_len only in ice_rx_ring (Petr Oros) [RHEL-115351]
  - ice: consistently use q_idx in ice_vc_cfg_qs_msg() (Petr Oros) [RHEL-115351]
  - ice: Implement ethtool reset support (Petr Oros) [RHEL-115351]
  - ice: Add correct PHY lane assignment (Petr Oros) [RHEL-115351]
  - ice: Fix ETH56G FC-FEC Rx offset value (Petr Oros) [RHEL-115351]
  - ice: Fix quad registers read on E825 (Petr Oros) [RHEL-115351]
  - ice: Fix E825 initialization (Petr Oros) [RHEL-115351]
  - unroll: add generic loop unroll helpers (CKI Backport Bot) [RHEL-115351]
  - devlink: add devlink_fmsg_dump_skb() function (Petr Oros) [RHEL-115351]
  - devlink: add devlink_fmsg_put() macro (Petr Oros) [RHEL-115351]
  - redhat: configs: enable CONFIG_PACKING (Petr Oros) [RHEL-115351]
  - lib: packing: catch kunit_kzalloc() failure in the pack() test (CKI Backport Bot) [RHEL-115351]
  - lib: packing: document recently added APIs (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add pack_fields() and unpack_fields() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: demote truncation error in pack() to a warning in __pack() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: create __pack() and __unpack() variants without error checking (CKI Backport Bot) [RHEL-115351]
  - lib: packing: use GENMASK() for box_mask (CKI Backport Bot) [RHEL-115351]
  - lib: packing: use BITS_PER_BYTE instead of 8 (CKI Backport Bot) [RHEL-115351]
  - lib: packing: fix QUIRK_MSB_ON_THE_RIGHT behavior (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add additional KUnit tests (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add KUnit tests adapted from selftests (CKI Backport Bot) [RHEL-115351]
  - lib: packing: duplicate pack() and unpack() implementations (CKI Backport Bot) [RHEL-115351]
  - lib: packing: add pack() and unpack() wrappers over packing() (CKI Backport Bot) [RHEL-115351]
  - lib: packing: remove kernel-doc from header file (CKI Backport Bot) [RHEL-115351]
  - lib: packing: adjust definitions and implementation for arbitrary buffer lengths (CKI Backport Bot) [RHEL-115351]
  - lib: packing: refuse operating on bit indices which exceed size of buffer (CKI Backport Bot) [RHEL-115351]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.1.1.el10_0]
changelog:
  - redhat: adjust rhel branch name (Jan Stancek)
  - redhat: set defaults for RHEL 10.0 (Jan Stancek)
  - Revert "x86/kvm: Override default caching mode for SEV-SNP and TDX" (Vitaly Kuznetsov) [RHEL-76109]


author: Jan Stancek <jstancek@redhat.com> [6.12.0-55.2.1.el10_0]
changelog:
  - Documentation/powerpc/fadump: add additional parameter feature details (Mamatha Inamdar) [RHEL-70827]
  - powerpc: increase MIN RMA size for CAS negotiation (Mamatha Inamdar) [RHEL-70827]
  - powerpc/fadump: fix additional param memory reservation for HASH MMU (Mamatha Inamdar) [RHEL-70827]
  - powerpc: export MIN RMA size (Mamatha Inamdar) [RHEL-70827]
  - scsi: mpi3mr: Update driver version to 8.12.1.0.50 (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Avoid reply queue full condition (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Handling of fault code for insufficient power (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Start controller indexing from 0 (Chandrakanth Patil) [RHEL-30789]
  - scsi: mpi3mr: Fix corrupt config pages PHY state is switched in sysfs (Chandrakanth Patil) [RHEL-30789] {CVE-2024-57804}
  - scsi: mpi3mr: Synchronize access to ioctl data buffer (Chandrakanth Patil) [RHEL-30789]
  - redhat: regenerate self-test data for new RHDISTGIT_BRANCH (Patrick Talbert)


author: EL Errata <el-errata_ww@oracle.com> - 31-11.0.1
changelog:
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Harshit Mogalapalli <harshit.m.mogalapalli@oracle.com> - 31-11.0.2
changelog:
  - Add improvement to modprobe to handle UEK8 packaging better [Orabug: 37771059] (Harshit Mogalapalli)


author: EL Errata <el-errata_ww@oracle.com> - 31-12.0.1
changelog:
  - Add improvement to modprobe to handle UEK8 packaging better [Orabug: 37771059] (Harshit Mogalapalli)
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.26-1
changelog:
  - New upstream release
  - Improve TX performance and use less CPU
  - minor other improvements
  - Build system update


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.27-1
changelog:
  - New upstream release
  - Fix potential startup race condition (corosync use case)
  - Fix crypto config check
  - Minor API cleanup
  - Test suite fixes


author: EL Errata <el-errata_ww@oracle.com> - 1.12-7.git869a25c.0.1
changelog:
  - Added bug30319244-remove-upstream-references.patch [Orabug: 30319244]
  - Added bug30285084-remove-upstream-references.patch [Orabug: 30285084]
  - Add oracle-remove-unfit-option.patch [Orabug: 23634996]
  - Removed forge references


author: Petr Menšík <pemensik@redhat.com> - 1.8.3-15
changelog:
  - Remove unneeded openssl/engine.h causing build failures
  - Explicitly disable openssl engine (RHEL-33736)


author: Dodji Seketeli <dodji@redhat.com> - 2.4-1
changelog:
  - Update to upstream 2.4 tarball
  - Drop patches
    0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch and
    0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch
  - Enable build with support for BTF
  - Added BuildRequires: libbpf-devel
  - Support soname bumped to libabigail.so.3.0.0


author: Dodji Seketeli <dodji@redhat.com> - 2.4-2
changelog:
  - Fix sourceware.org/PR31045
    "Don't try setting translation unit for unique types"
    Apply patch
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch.
    That patch is applied in upstream mainline and will be available in
    libabigail 2.5.
  - Use %autosetup instead of the previous %setup and %patch macros.
  - Add git as a build requirement


author: Dodji Seketeli <dodji@redhat.com> - 2.4-3
changelog:
  - Fix sourceware.org/PR31017
    "Support Flex array conversion suppression"
    Apply patch 0002-suppression-Add-has_strict_flexible_array_data_membe.patch


author: Dodji Seketeli <dodji@redhat.com> - 2.5-1
changelog:
  - Update to upstream 2.5 tarball
  - Drop patches (as they are now upstream):
    0001-Bug-31045-Don-t-try-setting-translation-unit-for-uni.patch
    0002-suppression-Add-has_strict_flexible_array_data_membe.patch
  - Enable abidb
  - Add BuildRequires: python3-devel
  - Add libabigail.so.4 and libabigail.so.4.0.0 to the RPM


author: Dodji Seketeli <dodji@redhat.com> - 2.6-1
changelog:
  - Update to upstream 2.6 tarball
  - Update to changing SONAME (libabigail.so.5.0.0)
  - Add BuildRequires xxhash-devel


author: Dodji Seketeli <dodji@redhat.com> - 2.8-1
changelog:
  - Update to upstream 2.8 tarball
  - Remove 0001-Fix-fedabipkgdiff-configure-check-for-Python-3.12.patch
    that is applied upstream.
  - Update to changing SONAME (libabigail.so.7.0.0)
  - Add xxhash-devel as BuildRequires and inlined-xxhash to avoid
    depending on it at runtime


author: Vojtech Trefny <vtrefny@redhat.com> - 2.8-21
changelog:
  - New version - 2.8 (Vojtech Trefny)
  - ci: Do not use release descriptions for Packit builds (Vojtech Trefny)
  - Do not hardcode pylint executable name in Makefile (Vojtech Trefny)
  - Remove unused test dependencies variables from Makefile (Vojtech Trefny)
  - docs: Remove information about Python 2 support (Vojtech Trefny)
  - Various docstring fixes (Vojtech Trefny)
  - Replace C++ style comments with C style (Vojtech Trefny)
  - Make use of error optional (Vojtech Trefny)
  - spec: Fix source archive URL (Vojtech Trefny)
  - ci: Add Packit automation for downstream builds (Vojtech Trefny)
  - spec: Bump release to 21 for Packit daily builds (Vojtech Trefny)
  - ci: Use Packit for daily builds in Copr (Vojtech Trefny)
  - ci: Remove GitHub action for RPM builds (Vojtech Trefny)
  - ci: Add Packit configuration for RPM builds on pull requests (Vojtech Trefny)
  - configure.ac: Remove invalid email address for bug reports (Vojtech Trefny)
  - ci: Update chroots for RPM builds (Vojtech Trefny)
  - Translated using Weblate (Kazakh) (Baurzhan Muftakhidinov)
  - Added translation using Weblate (Kazakh) (Baurzhan Muftakhidinov)
  - misc: Remove "warn: false" from Ansible "command" (Vojtech Trefny)
  - Translated using Weblate (Georgian) (Temuri Doghonadze)
  - spec: Change license string to the SPDX format required by Fedora (Vojtech Trefny)
  - Added translation using Weblate (Georgian) (Temuri Doghonadze)
  - Update translation files (Weblate)
  - Translated using Weblate (Korean) (김인수)
  - ci: Update Fedora versions for RPM build tests (Vojtech Trefny)
  - ci: Rename csmock.Dockerfile to ci.Dockerfile (Vojtech Trefny)
  - ci: Update the csmock GitHub actions configuration (Vojtech Trefny)
  - ci: Run rpmbuild tests in GitHub actions (Vojtech Trefny)
  - Add a GitHub action for running csmock static analysis (Vojtech Trefny)
  - README: Remove the Travis CI badge (Vojtech Trefny)
  - Sync spec with downstream (Vojtech Trefny)


author: Packit <hello@packit.dev> - 2.9-21
changelog:
  - New version - 2.9 (Vojtech Trefny)
  - build: Exit before AC_OUTPUT on error (Tomas Bzatek)
  - tests: fix locale tests on musl (triallax)
  - Update translation files (Weblate)
  - Translated using Weblate (Korean) (김인수)
  - ci: Manually prepare spec file for Packit (Vojtech Trefny)


author: Packit <hello@packit.dev> - 2.10-1
changelog:
  - New version - 2.10 (Vojtech Trefny)
  - Rename 'master' branch to 'main' (Vojtech Trefny)
  - remove dependency on python3-six and python2 crumbs (Alexandre Detiste)
  - ci: Bump actions/checkout from v3 to v4 (Vojtech Trefny)
  - Squashed 'translation-canary/' changes from 4d4e65b..5bb8125 (Vojtech Trefny)
  - dist: Fix release number in spec (Vojtech Trefny)


author: Jan Kolarik <jkolarik@redhat.com> - 0.1.20-1
changelog:
  - Update to 0.1.20
  - Fixes of xml parsing
  - Fix non-optimized builds by removing inline keyword
  - Use Py_hash_t instead of long


author: Pavol Žáčik <pzacik@redhat.com> - 0.6.5-3
changelog:
  - Patch bugs found by static analysis tools
  - Add %{name}-fix-handle-leaks-in-rdmsr-c.patch
  - Add %{name}-fix-cpuid_get_hypervisor.patch
  - Add %{name}-prevent-intel_fn11-array-overruns.patch


author: Pavol Žáčik <pzacik@redhat.com> - 0.7.0-1
changelog:
  - Rebase to 0.7.0
  - Begin building the package for aarch64
  - Add Python bindings as a subpackage (python3-libcpuid)


author: EL Errata <el-errata_ww@oracle.com> - 0.73.1-12.0.1
changelog:
  - Recognise new kernel-uek RPMs as multiversion and installonlypkg [Orabug: 36053872]
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - Update OL9 dnf to recognize UEK7(kernel-uek-core & kernel-uek-modules) as installonlypkgs package [Orabug: 33861607]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584]
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]


author: Evan Goode <egoode@redhat.com> - 0.73.1-1
changelog:
  - Update to 0.73.1 (RHEL-38831)
  - Fix https://issues.redhat.com/browse/RHEL-27657 (RHEL-32935)
  - subject-py: Fix memory leak (RHEL-32924)
  - MergedTransaction: Calculate RPM difference between two same versions as
    no-op (RHEL-33541)
  - Onboard packit tests
  - Add virtual destructor to TransactionItem (RHEL-32943)


author: Petr Pisar <ppisar@redhat.com> - 0.73.1-2
changelog:
  - Fix reinstalling packages which conflicts with themselves in
    dnf_transaction_commit() (RHEL-32919)
  - Fix an invalid memory access when dropping an item in MergedTransaction
    class (RHEL-33541)


author: Pavel Cahyna <pcahyna@redhat.com> - 6.1.3-8
changelog:
  - migrated to SPDX license, originally from Fedora by <msuchy>
  - Correct License: some files are GPL 2 or GPL 3, but not later


author: Attila Lakatos <alakatos@redhat.com> - 1.2304.0-1
changelog:
  - Rebase to 1.2304.0 (new release number scheme, now like rsyslog)
  Resolves: rhbz#2183193
  - Address CVE-2020-12762
  Resolves: rhbz#2203170


author: Karel Zak <kzak@redhat.com> - 2.40.2-3
changelog:
  - revert recent uuidd mode changes
  - rebase rhel specific patches
  - fix uuidd-tmpfiles.conf (upstream patch)
  - remove unused patches


author: Gary Buhrmaster <gary.buhrmaster@gmail.com> - 1.13.0-1
changelog:
  - Update to 1.13.0 release ( resolves: rhbz#2172297 )
  - Perform some deglobing of files per packaging guidelines


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.52.1-1
changelog:
  - New stable branch version 1.52.1
  - Remove lua, perl, ruby, php and gobject bindings in RHEL
  - Remove gdisk dependency for RHEL
    resolves: RHEL-35998


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.52.2-1
changelog:
  - Rebase to libguestfs 1.52.2 (along the stable branch)
  - Remove dependency on syslinux packages
    resolves: RHEL-50565


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.52.2-4
changelog:
  - Synchronize patches with RHEL 9.5
    resolves: RHEL-56325
  - appliance/init: Don't set impossible "noop" disk scheduler
    resolves: RHEL-56157


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.54.0-5
changelog:
  - Rebase to libguestfs 1.54.0
    resolves: RHEL-56810
  - Fix osinfo for Windows Server 2025
    resolves: RHEL-62989
  - Replace Jansson with json-c
    resolves: RHEL-65293
  - Remove squashfs-tools on RHEL
    resolves: RHEL-68937
  - Fix perl-Sys-Guestfs debuginfo
    resolves: RHEL-68973


author: EL Errata <el-errata_ww@oracle.com> - 1.54.0-5.0.1
changelog:
  - Add btrfs-progs to the packages installed in the appliance [Orabug: 34137448]
  - Replace upstream references from a description tag
  - Fix build on Oracle Linux [Orabug: 29319324]
  - Set DISTRO_ORACLE_LINUX correspeonding to ol


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.56.1-3
changelog:
  - Rebase to libguestfs 1.56.1
    resolves: RHEL-81733
  - Include host kernel information in libguestfs debugging output
    resolves: RHEL-83026
  - Fix virt-v2v conversion of split /usr Ubuntu 22+
    resolves: RHEL-87622
  - Remove dependencies on oUnit, flex, bison, file-devel
  - Remove zfs-fuse (not used in RHEL)
  - Fix gating test
  - Fix inspection with duplicated root mountpoint
    resolves: RHEL-90170
  - Add btrfs-scrub-full API
    resolves: RHEL-91936
  - Add e2fsck forceno flag
    resolves: RHEL-92599
  - Capture and raise qemu-img stderr
    resolves: RHEL-92239
  - Ignore btrfs snapshots of roots
    resolves: RHEL-93109
  - Add /etc/fstab, lsblk and blkid to verbose output
    resolves: RHEL-106490
  - Fix conversion of SLES15 with encrypted btrfs filesystem
    resolves: RHEL-93584
  - Add guestfs_setfiles API
    resolves: RHEL-108832
  - Ignore blank disks in Windows drive mapping
    resolves: RHEL-109258


author: Tomas Popela <tpopela@redhat.com> - 1.0.5-19
changelog:
  - Disable python support. This package is only in RHEL 10, because
    tracker-miners requires it and it doesn't need the Python bits.
  - Resolves: RHEL-52843


author: Mark Will <mark.will@oracle.com> - 0:4.21.3-104
changelog:
  - resolves: RHEL-75587 - Fix deadlock between two smbd processes
  - resolves: RHEL-85348 - Fix winbindd memory leak


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 0:4.21.3-113
changelog:
  - Rebuild for zstream
  - Fix 'net ads join' in setups with multiple DCs
  - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-106)
  - Fix winbind fork bomb in 'IPA with AD trust'
    environment
  - Fix samba-gpupdate to process empty GPO Link
  - Fix 'net ads kerberos kinit'
  - smb.conf: Remove the '@' for NIX groups, we
    removed NIS support


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-104
changelog:
  - resolves: RHEL-101759 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-103.el10)


author: Jerry James <loganjerry@gmail.com> - 3.28.0-1
changelog:
  - Update to 3.28.0
  - Install internal.h for MuseScore
  - Drop ancient obsoletes
  - Build the python package with dist-info
  - Add tables subpackage for the noarch data
  - Complete and correct SPDX migration
  - Remove need for chrpath
  - Minor spec file cleanups


author: Richard W.M. Jones <rjones@redhat.com> - 1.20.2-2
changelog:
  - Rebase to libnbd 1.20.2
  - Fix multiple flaws in TLS server certificate checking
    resolves: RHEL-49802
  - Print full NBD error from server
    resolves: RHEL-50667


author: Richard W.M. Jones <rjones@redhat.com> - 1.22.2-2
changelog:
  - Rebase to libnbd 1.22.2
  - Synch spec file with Fedora Rawhide.
    resolves: RHEL-78831
  - Fix nbdinfo with dark theme
    resolves: RHEL-7119
  - Add nbdcopy --blkhash option
    resolves: RHEL-85513
  - Log the version of libnbd / nbdcopy in virt-v2v output
    resolves: RHEL-104019


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-0
changelog:
  - Updated to the latest release: nfs-utils-2-8-2 (RHEL-67786)
    Resolves: RHEL-65826
    Resolves: RHEL-67041
    Resolves: RHEL-67168
    Resolves: RHEL-67786
    Resolves: RHEL-68575


author: Scott Mayhew <smayhew@redhat.com> 2.8.2-3
changelog:
  - fix ownership of /var/lib/nfs/statd/state (RHEL-77913)
  - /var/lib/nfs/{etab,rmtab} should not be marked as config files (RHEL-77912)


author: Scott Mayhew <smayhew@redhat.com> 2.8.3-0
changelog:
  - Updated to nfs-utils-2-8-3 plus additional fixes from 2-8-4-rc1 (RHEL-88768)
    Resolves: RHEL-71286
    Resolves: RHEL-82418
    Resolves: RHEL-82557
    Resolves: RHEL-85409
    Resolves: RHEL-85413
    Resolves: RHEL-88768


author: Remi Collet <remi@remirepo.net> - 0.12.0-1
changelog:
  - update to 0.12.0
  - add patch to not install the static library, from
    https://github.com/alanxz/rabbitmq-c/pull/749
  - add patch to fix version in pkgconfig file, from
    https://github.com/alanxz/rabbitmq-c/pull/751


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.0-1
changelog:
  - Update to 1.17.0
  - lr_gpg_check_signature: Forward PGP error messages from RPM
  - PGP: fix: Support importing binary public keys in librpm backend
  - PGP: Enable creating a UID directory for GnuGP agent socket in /run/gnupg/user
  - PGP: Set a default creation SELinux labels on GnuPG directories


author: Jan Kolarik <jkolarik@redhat.com> - 1.17.1-1
changelog:
  - Update to 1.17.1 (RHEL-38831)
  - gpg_gpgme.c: fix build errors with older gcc
  - Change header files to match a configured ABI regarding a zchunk support
  - Fix building zchunk code if zchunk is enabled
  - Fix compiler warnings


author: Evan Goode <egoode@redhat.com> - 1.18.0-1
changelog:
  - Update to 1.18.0 (RHEL-35699)
  - API: Add LRO_USERNAME and LRO_PASSWORD options
  - Add a private dependency on zck to librepo.pc if zchunk support is enabled
  - Hash cache: Improved work with extended file attributes
  - Improve performance of large number of package downloads
  - Fix error handling, Fix examples and build them


author: Petr Pisar <ppisar@redhat.com> - 1.18.0-2
changelog:
  - Use librpmio instead of gpgme for handling PGP keys (RHEL-47106)
  - Fix a memory leak in select_next_target() (RHEL-35699)


author: Petr Pisar <ppisar@redhat.com> - 0.0.3-14
changelog:
  - Improve a documentation (RHEL-38831)
  - Refactor parse_entitlement_data() (RHEL-32365)
  - Fix relocating certificate paths to /etc/rhsm-host (RHEL-37866)


author: Romain Geissler <romain.geissler@amadeus.com> - 0.21.2-8
changelog:
  - Backport packaging of mock service from Fedora in order to consume it in EPEL
    Resolves: RHEL-81780


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-3
changelog:
  - restorecon: Include <selinux/label.h> (RHEL-53852)
  - Fix integer comparison issues when compiling for 32-bit


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-5
changelog:
  - setexecfilecon: Remove useless rc check (RHEL-35586)
  - matchpathcon: RESOURCE_LEAK: Variable "con" (RHEL-35584)


author: Vit Mojzis <vmojzis@redhat.com> - 3.7-4
changelog:
  - cil: Check that sym_index is within bounds (RHEL-34823)
  - cil: Initialize avtab_datum on declaration (RHEL-34810)
  - mls: Do not destroy context on memory error (RHEL-34810)
  - cil/cil_post: Initialize tmp on declaration (RHEL-34810)
  - Initialize "strs" on declaration (RHEL-34810)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.1.0-7
changelog:
  - update license tag format (SPDX migration) for https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.0-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-56701 - sss_ssh_knownhosts is breaking ansible-pull
  - Resolves: RHEL-55993 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not


author: Alexey Tikhonov <atikhono@redhat.com> - 2.10.1-1
changelog:
  - Resolves: RHEL-62725 - Rebase SSSD for RHEL 10.0
  - Resolves: RHEL-4984 - Mismatch between input and parsed domain name when default_domain_suffix is set.
  - Resolves: RHEL-65848 - sssd password authentication broken in sssd-2.10.0~beta2-2 and later
  - Resolves: RHEL-67669 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option
  - Resolves: RHEL-68421 - sssd ldap_child process segfaults when krb5.conf is invalid [rhel-10]
  - Resolves: RHEL-66935 - Avoid log flooding in case an app keeps making invalid `getservbyport(0, ...)` request
  - Resolves: RHEL-65736 - ipa: sudo commands doesn't check threshold correctly
  - Resolves: RHEL-68319 - Please deprecate/remove ad_allow_remote_domain_local_groups


author: Masahiro Matsuya <mmatsuya@redhat.com> - 2.10.2-3.3
changelog:
  - Resolves: RHEL-120286 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.0-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-4976 - [RFE] Continue searching other PKCS#11 tokens if certificates are not found
  - Resolves: RHEL-87200 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack
  - Resolves: RHEL-25593 - Improve sssd-simple man page description
  - Resolves: RHEL-14752 - [RFE] Add IPA subdomain support to allow IPA-IPA trust
  - Resolves: RHEL-92569 - SSSD LDAPU1 Mapping braces problem
  - Resolves: RHEL-4981 - p11_child currently has an infinite timeout
  - Resolves: RHEL-5042 - IDM homedir %o is not working, returns /home/domain/user instead of AD POSIX unixHomeDir
  - Resolves: RHEL-13086 - [RFE] Anonymous bind requests on RootDSE
  - Resolves: RHEL-45824 - SSSD unable to enumerate LDAP groups if LDAP server contains any group with # character in their names


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-1
changelog:
  - Resolves: RHEL-95058 - Rebase SSSD for RHEL 10.1
  - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache


author: Alexey Tikhonov <atikhono@redhat.com> - 2.11.1-2
changelog:
  - Related: RHEL-77184 - AD user in external group is not cleared when expiring the cache
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Sumit Bose <sbose@redhat.com> - 2.11.1-2.1
changelog:
  - Resovles: RHEL-120288 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows
    privilege escalation on AD-joined Linux systems [rhel-10.1.z]


author: Matej Mužila <mmuzila@redhat.com> - 4.5.0-3
changelog:
  - New upstream release 4.5.0 (#2153870)
  - Fix CVE-2022-3570, CVE-2022-2867, CVE-2022-2868, CVE-2022-2869, CVE-2022-2519,
    CVE-2022-2953, CVE-2022-3597, CVE-2022-3598, CVE-2022-3599, CVE-2022-3626,
    CVE-2022-3627, CVE-2022-3970 (#2142735, #2118854, #2118867, #2118875,


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.1-3
changelog:
  - Use a SPDX license tag
  - udiskslinuxblockobject: Try issuing BLKRRPART ioctl harder
  - udiskslinuxmanager: Fix use after free
  - tests: Fix targetcli_config.json


author: Tomas Bzatek <tbzatek@redhat.com> - 2.10.90-4
changelog:
  - Rebase to upstream 2.10.90 (pre-)release
  - lvm2: Try opening for unused device detection harder (RHEL-39935)


author: Jiri Denemark <jdenemar@redhat.com> - 10.9.0-1
changelog:
  - Rebased to libvirt-10.9.0 (RHEL-50577)
  - The rebase also fixes the following bugs:
      RHEL-753, RHEL-62174


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-1
changelog:
  - Rebased to libvirt-10.10.0 (RHEL-50577)
  - The rebase also fixes the following bugs:
      RHEL-58152, RHEL-65187, RHEL-65268, RHEL-66222, RHEL-66223
      RHEL-68066, RHEL-69449


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-2
changelog:
  - util: Fix typo in virNetDevOpenvswitchInterfaceSetQos (RHEL-69840)
  - qemu: tpm: do not update profile name for transient domains (RHEL-69774)
  - qemu: Enable I/O APIC if needed (RHEL-71414)
  - cpu_map: Sort data files in meson.build (RHEL-70129)
  - sync_qemu_models_i386: Update meson.build (RHEL-70129)
  - sync_qemu_models_i386: Generate missing -v1 variants (RHEL-70129)
  - cpu_map: Add 486-v1 CPU model (RHEL-70129)
  - cpu_map: Add pentium-v1 CPU model (RHEL-70129)
  - cpu_map: Add pentium2-v1 CPU model (RHEL-70129)
  - cpu_map: Add pentium3-v1 CPU model (RHEL-70129)
  - cpu_map: Add coreduo-v1 CPU model (RHEL-70129)
  - cpu_map: Add n270-v1 CPU model (RHEL-70129)
  - cpu_map: Add core2duo-v1 CPU model (RHEL-70129)
  - cpu_map: Add qemu32-v1 CPU model (RHEL-70129)
  - cpu_map: Add kvm32-v1 CPU model (RHEL-70129)
  - cpu_map: Add qemu64-v1 CPU model (RHEL-70129)
  - cpu_map: Add kvm64-v1 CPU model (RHEL-70129)
  - cpu_map: Add Conroe-v1 CPU model (RHEL-70129)
  - cpu_map: Add Penryn-v1 CPU model (RHEL-70129)
  - cpu_map: Add KnightsMill-v1 CPU model (RHEL-70129)
  - cpu_map: Add athlon-v1 CPU model (RHEL-70129)
  - cpu_map: Add phenom-v1 CPU model (RHEL-70129)
  - cpu_map: Add Opteron_G1-v1 CPU model (RHEL-70129)
  - cpu_map: Add Opteron_G2-v1 CPU model (RHEL-70129)
  - cpu_map: Add Opteron_G3-v1 CPU model (RHEL-70129)
  - cpu_map: Add Opteron_G4-v1 CPU model (RHEL-70129)
  - cpu_map: Add Opteron_G5-v1 CPU model (RHEL-70129)
  - cpu_map: Add EPYC-Genoa-v1 CPU model (RHEL-70129)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-3
changelog:
  - qemu: Enable I/O APIC even more frequently (RHEL-71414)
  - cpu_map: Add avx10* CPU features (RHEL-71897)
  - cpu_map: Add GraniteRapids-v2 CPU model (RHEL-71897)
  - cpu_map: Add sha512, sm3, and sm4 CPU features (RHEL-71898)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-4
changelog:
  - conf, docs: Add support for direct and extended tlbflush features (RHEL-73088)
  - qemu: Add support for direct and extended tlbflush features (RHEL-73088)
  - conf: refactor hyperv features formatting (RHEL-73088)
  - conf: Adjust hyperv tlbflush formatting (RHEL-73088)
  - qemu_migration: Do not consider post-copy active in postcopy-recover (RHEL-73699)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-5
changelog:
  - qemu: allow migration of guest with mdev vGPU to VF vGPU (RHEL-68065)
  - storage_file: Refuse qcow2 images with empty string as 'data_file' (RHEL-70627)
  - virstoragetest: Add case for qcow2 image with empty string as 'data_file' (RHEL-70627)
  - qemu: snapshot: delete disk image only if parent snapshot is external (RHEL-74040)
  - storage_file: de-modularize the local file backend (RHEL-73506)
  - libvirt.spec: Move ownership of 'storage-file' backends directory to gluster (RHEL-73506)
  - tools: ssh-proxy: Check for domain status before parsing its CID (RHEL-75589)
  - qemu: re-use existing ActualNetDef for more interface types during update-device (RHEL-74492)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-6
changelog:
  - build: Bump minimum glib2 version to 2.66.0 (RHEL-76802)
  - qemuProcessHandleIOError: Refactor to extract 'priv' instead of 'driver' (RHEL-76802)
  - qemu: Handle quirks of 'device' field of BLOCK_IO_ERROR event in monitor code (RHEL-76802)
  - qemu: Rename 'diskAlias' to 'device' in qemu IO error event handling (RHEL-76802)
  - qemuProcessHandleIOError: Rename local variables (RHEL-76802)
  - qemuMonitorJSONHandleIOError: Do not munge 'reason' field of IO error event (RHEL-76802)
  - qemuProcessHandleIOError: Prefer lookup by node name (RHEL-76802)
  - qemuMonitorJSONHandleIOError: Propagate new 'qom-path' field (RHEL-76802)
  - virStorageSource: Add fields for storing last I/O error message (RHEL-76802)
  - qemuProcessHandleIOError: Populate I/O error reason to virStorageSource (RHEL-76802)
  - qemuProcessHandleIOError: Log IO errors in the VM log file (RHEL-76802)
  - libxlDomainGetMessages: Add existing flags to 'virCheckFlags' (RHEL-76802)
  - virDomainObjGetMessages: Refactor using GPtrArray (RHEL-76802)
  - virDomainGetMessages: Introduce VIR_DOMAIN_MESSAGE_IOERRORS (RHEL-76802)
  - include: libvirt-domain: Reword documentation for @reason of VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON (RHEL-76802)
  - include: libvirt-domain: Add 'message' @reason of VIR_DOMAIN_EVENT_ID_IO_ERROR_REASON (RHEL-76802)
  - qemuSnapshotForEachQcow2: Don't initialize 'nrollback' (RHEL-78186)
  - qemu: process: Export qemuPrepareNVRAM for use in snapshot code (RHEL-78186)
  - qemu: snapshot: Ensure that NVRAM image exists when taking inactive internal snapshot (RHEL-78186)
  - qemuxmlconftest: Allow testing of the 'writable' flag for passed FDs for disks (RHEL-78353)
  - qemuxmlconftest: Add testing of FDs with 'writable' flag in 'disk-source-fd' (RHEL-78353)
  - qemu: domain: Initialize FD passthrough for a virStorageSource before using it (RHEL-78353)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7
changelog:
  - qemu_migration: Refactor qemuMigrationSrcRestoreDomainState (RHEL-1071)
  - qemu_migration: Do not automatically resume domain after I/O error (RHEL-1071)
  - qemucapabilitiestest: Add data for the qemu-10.0 dev cycle on x86_64 (RHEL-78398)
  - qemucapabilitiestest: Update 'caps_10.0.0_x86_64' to 'v9.2.0-1636-gffaf7f0376' (RHEL-78398)
  - qemu: capabilies: Introduce QEMU_CAPS_BLOCKDEV_SET_ACTIVE (RHEL-78398)
  - qemu: monitor: Add monitor backend for 'blockdev-set-active' (RHEL-78398)
  - qemu: migration: Reactivate block nodes after migration if VM is left paused (RHEL-78398)
  - conf: change virDomainHostdevInsert() to return void (RHEL-77086)
  - qemu: fix qemu validation to forbid guest-side IP address for type='vdpa' (RHEL-77086)
  - qemu: validate that model is virtio for vhostuser and vdpa interfaces in the same place (RHEL-77086)
  - qemu: automatically set model type='virtio' for interface type='vhostuser' (RHEL-77086)
  - qemu: do all vhostuser attribute validation in qemu driver (RHEL-77086)
  - conf/qemu: make <source> element *almost* optional for type=vhostuser (RHEL-77086)
  - qemu: use switch instead of if in qemuProcessPrepareDomainNetwork() (RHEL-77086)
  - qemu: make qemuPasstCreateSocketPath() public (RHEL-77086)
  - qemu: complete vhostuser + passt support (RHEL-77086)
  - qemu: fail validation if a domain def has vhostuser/passt but no shared mem (RHEL-77086)
  - docs: improve type='user' docs to higlight differences between SLIRP and passt (RHEL-77086)
  - docs: document using passt backend with <interface type='vhostuser'> (RHEL-77086)
  - utils: Canonicalize paths before comparing them (RHEL-79165)


author: Darren Archibald <darren.archibald@oracle.com> - 10.10.0-8
changelog:
  - remote: add sysusers file to create 'libvirt' group
  - qemu: Avoid crash in qemuDomainCheckCPU with unknown host CPU
  - qemu_snapshot: allow reverting to external disk only snapshot
  - qemu: snapshot: error out early when reverting snapshot for VM with non-file disk


author: David Sloboda <david.x.sloboda@oracle.com> - 10.10.0-8.1
changelog:
  - util: introduce object for holding a system inhibitor lock (RHEL-83064)
  - src: convert drivers over to new virInhibitor APIs (RHEL-83064)
  - rpc: remove logind support for virNetDaemon (RHEL-83064)
  - util: fix off-by-1 in inhibitor constants (RHEL-83064)
  - util: don't attempt to acquire logind inhibitor if not requested (RHEL-83064)
  - network: Free inhibitor in networkStateCleanup() (RHEL-83064)
  - conf: parse interface/source/@dev for all interface types (with backend type='passt') (RHEL-82539)
  - qemu: remove nonsensical sanity check in processNetdevStreamDisconnectedEvent() (RHEL-80169)
  - qemu: make processNetDevStreamDisconnectedEvent() reusable (RHEL-80169)
  - qemu: respond to NETDEV_VHOST_USER_DISCONNECTED event (RHEL-80169)
  - qemu: put vhost-user code that's special for passt in a helper function (RHEL-80169)
  - qemu: make passt+vhostuser reconnect behave identically to passt+user (RHEL-80169)


author: Akshata Konala <akshata.konala@oracle.com> - 10.10.0-8.3
changelog:
  - qemuPrepareNVRAMFile: Fix NVRAM image conversion check (RHEL-97761)
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-95956)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-95956)
  - qemu_capabilities: query deprecated features for host-model (RHEL-95956)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-95956)
  - qemu_capabilities: filter deprecated features if requested (RHEL-95956)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-95956)
  - conf: add deprecated_features attribute (RHEL-95956)


author: Darren Archibald <darren.archibald@oracle.com> - 10.10.0-8.4
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-106278)
  - qemu: sanitize blank lines in config file (RHEL-106278)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-106278)


author: Jiri Denemark <jdenemar@redhat.com> - 11.1.0-1
changelog:
  - Rebased to libvirt-11.1.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-7041, RHEL-7042, RHEL-7104, RHEL-7342, RHEL-20294
      RHEL-41264, RHEL-52493, RHEL-58933, RHEL-70656, RHEL-71042
      RHEL-71810, RHEL-72021, RHEL-72052, RHEL-72192, RHEL-72994
      RHEL-79088, RHEL-79460, RHEL-79465, RHEL-79953


author: Jiri Denemark <jdenemar@redhat.com> - 11.2.0-1
changelog:
  - Rebased to libvirt-11.2.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-7035, RHEL-24046, RHEL-40077, RHEL-58151, RHEL-68043
      RHEL-71883, RHEL-72994, RHEL-77552, RHEL-80166, RHEL-80533
      RHEL-80688, RHEL-81731, RHEL-81890, RHEL-83148, RHEL-84257
      RHEL-84688
  - cpu_map: Install Ampere-1 ARM CPU models (RHEL-71662)


author: Jiri Denemark <jdenemar@redhat.com> - 11.3.0-1
changelog:
  - Rebased to libvirt-11.3.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-27172, RHEL-79088, RHEL-82411, RHEL-84257, RHEL-85320
      RHEL-85414, RHEL-85672, RHEL-86523, RHEL-86776, RHEL-86778


author: Jiri Denemark <jdenemar@redhat.com> - 11.4.0-1
changelog:
  - Rebased to libvirt-11.4.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-79460, RHEL-84783, RHEL-85414, RHEL-86952, RHEL-87177
      RHEL-88747, RHEL-89414, RHEL-90160, RHEL-90625, RHEL-92510


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-1
changelog:
  - Rebased to libvirt-11.5.0 (RHEL-71662)
  - The rebase also fixes the following bugs:
      RHEL-86592, RHEL-93775, RHEL-95749, RHEL-100109


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-2
changelog:
  - virSystemdCreateMachine: Document @maxthreds (RHEL-95361)
  - cgroup: Unexport 'virDomainCgroupInitCgroup' (RHEL-95361)
  - qemu: conf: Store 'autoShutdown' config in virDomainDriverAutoShutdownConfig (RHEL-95361)
  - hypervisor: domain: Extract logic for auto shutdown to virDomainDriverAutoShutdownActive (RHEL-95361)
  - virSystemdCreateMachine: Add flag to invert machined unit dependencies (RHEL-95361)
  - cgroup: Plumb the 'daemonDomainShutdown' parameter of 'virSystemdCreateMachine' to drivers (RHEL-95361)
  - qemu: Fix auto-shutdown of qemu VMs by the qemu driver (RHEL-95361)
  - hypervisor: Split out individual steps out of virDomainDriverAutoShutdown (RHEL-95196)
  - virDomainDriverAutoShutdownDoSave: Don't attempt to save transient VMs (RHEL-95196)
  - virDomainDriverAutoShutdown: Refactor selection logic for VMs (RHEL-95196)
  - tls: Don't require 'keyEncipherment' to be enabled altoghther (RHEL-100711)
  - kbase: tlscerts: Drop 'encryption_key' feature request (RHEL-100711)
  - tests: virnettls*test: Drop use of GNUTLS_KEY_KEY_ENCIPHERMENT (RHEL-100711)
  - qemu_tpm: Rename qemuTPMHasSharedStorage -> qemuTPMDomainHasSharedStorage (RHEL-80155)
  - qemu_tpm: Extract per-TPM functionality from qemuTPMDomainHasSharedStorage (RHEL-80155)
  - qemu_tpm: Only warn about missing locking feature on shared filesystems (RHEL-80155)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-104382)
  - qemu: sanitize blank lines in config file (RHEL-104382)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-104382)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.1.el10_1
changelog:
  - tools: Secure guest check for Intel in virt-host-validate (RHEL-111863)
  - qemu: Check if INTEL Trust Domain Extention support is enabled (RHEL-111863)
  - qemucapabilitiesdata: Document '+inteltdx' variant (RHEL-111863)
  - qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant (RHEL-111863)
  - qemu: Add QEMU_CAPS_TDX_GUEST capability (RHEL-111863)
  - conf: Expose TDX feature in domain capabilities (RHEL-111863)
  - conf: Add tdx as launch security type (RHEL-111863)
  - conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig (RHEL-111863)
  - qemu: Add command line and validation for TDX type (RHEL-111863)
  - conf: Expose TDX type in domain launch security capability (RHEL-111863)
  - qemu: Force special parameters enabled for TDX guest (RHEL-111863)
  - qemu: log the crash information for TDX (RHEL-111863)
  - qemu_firmware: Pick the right firmware for TDX guests (RHEL-111863)
  - conf: Add Intel TDX Quote Generation Service(QGS) support (RHEL-111863)
  - qemu: Add command line for TDX Quote Generation Service(QGS) (RHEL-111863)
  - qemu: Add FakeReboot support for TDX guest (RHEL-111863)
  - qemu: Support reboot command in guest (RHEL-111863)
  - qemu: Avoid duplicate FakeReboot for secure guest (RHEL-111863)
  - qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation (RHEL-111863)
  - qemu: Support domain reset command for TDX guest (RHEL-111863)
  - qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data (RHEL-111863)
  - docs: domain: Add documentation for Intel TDX guest (RHEL-111863)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.2.el10_1
changelog:
  - cpu_conf: Make virCPUDefFilterFeatures return void (RHEL-126094)
  - qemu_domain: Simplify qemuDomainFixupCPUs (RHEL-126094)
  - qemu_domain: Fix qemuDomainFixupCPUs (RHEL-126094)
  - qemu_process: Always fix CPUs on reconnect (RHEL-126094)
  - qemu_monitor: Filter CPU features reported by QEMU (RHEL-126094)
  - qemu: Ignore "ht" CPU feature (RHEL-126094)


author: Jiri Denemark <jdenemar@redhat.com> - 11.5.0-4.5.el10_1
changelog:
  - esx: Allow disk images in subdirectories (RHEL-140865)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-140465)
  - esx: URI encode inventory objects twice (RHEL-140465)


author: Ville-Pekka Vainio <vpvainio@iki.fi> - 4.3.2-1
changelog:
  - New upstream release
  - Update C++ standard from C++11 to C++14
  - Compilation fixes for recent versions of GCC
  - Small fixes to Finnish grammar checker


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.7.2-10
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-93091
  - Remove deprecated path from systemd service file
    Resolves: RHEL-101169


author: David King <dking@redhat.com> - 2.12.5-6
changelog:
  - Fix CVE-2025-6021 (RHEL-96495)
  - Fix CVE-2025-49794 (RHEL-96395)
  - Fix CVE-2025-49795 (RHEL-96408)
  - Fix CVE-2025-49796 (RHEL-96421)


author: Tom Callaway <spot@fedoraproject.org> - 5.4.6-3
changelog:
  - disable "corrupted binary dump" test that has issues on big-endian architectures
  - apply upstream fix for 5.4.6 bug 1


author: Kevin Lyons <kevin.x.lyons@oracle.com> - 24.2.8-3
changelog:
  - util/disk_cache: Do not try to delete old cache if cache is disabled
  - docs: Update MESA_SHADER_CACHE_DIR env variable behavior
    [RHEL-108122]


author: Miro Hrončok <mhroncok@redhat.com> - 2.5.1-6
changelog:
  - Split libmpdec++ into a mpdecimal++ subpackage
  - This prevents packages only using the libmpdec library from transitively depending on libstdc++


author: Charalampos Stratakis <cstratak@redhat.com> - 2.5.1-11
changelog:
  - Fix bind-now annocheck failure by passing the proper LDFLAGS to the C++ library
  Resolves: RHEL-33509


author: Cristian Le <cristian.le@mpsd.mpg.de> - 4.1.2-13
changelog:
  - Added CMAKE_PREFIX_PATH to the module file to unsure that CMake projects
    find the available MPI enabled packages, libraries, executables, etc.


author: Dominik Mierzejewski <rpm@greysector.net> - 2.16.01-1
changelog:
  - update to 2.16.01 (#2155636)
  - drop obsolete patch
  - drop rdoff subpackage (discontinued upstream)


author: Richard W.M. Jones <rjones@redhat.com> - 1.40.0-2
changelog:
  - Rebase to nbdkit 1.40.0
    related: RHEL-49594
  - Send the last error to the NBD client
    resolves: RHEL-50666


author: Richard W.M. Jones <rjones@redhat.com> - 1.44.1-2
changelog:
  - Rebase to nbdkit 1.44.1
    resolves: RHEL-78830, RHEL-101180
  - Synch the spec file with Fedora Rawhide.
  - nbdkit-ondemand-plugin moves into a new subpackage.
  - New nbdkit-count-filter & nbdkit-time-limit-filter.
  - Remove nbdkit-cacheextents-filter.
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85515
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89371
  - vddk: Pre-cache the extents for readonly connections
    resolves: RHEL-94825
  - Log filename, offset and count in nbdkit-file-plugin error messages
    resolves: RHEL-95364
  - vddk: Improve statistics
    related: RHEL-94825
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95819
  - Add support for VDDK 9.0.0.0
    resolves: RHEL-99467
  - server: Fix .zero fallback path
    resolves: RHEL-101636


author: Florian Weimer <fweimer@redhat.com> - 11.02.00-5
changelog:
  - GCC 14 compatibility fixes:
    Drop netpbm-cmuwtopbm.patch to fix an out-of-bounds stack write (#2259450)
    Stub out unused converter/other/jpeg2000/libjasper_compat.c (#2259448)


author: Phil Sutter <psutter@redhat.com> - 1:1.0.9-1
changelog:
  - Fix devel sub-package description
  - Utilize pyproject-rpm-macros for the python sub-package
  - new version 1.0.9


author: Phil Sutter <psutter@redhat.com> [1.1.1-1.el10]
changelog:
  - monitor: Recognize flowtable add/del events (Phil Sutter) [RHEL-65346]
  - tests: py: Fix for storing payload into missing file (Phil Sutter) [RHEL-65346]
  - json: Support typeof in set and map types (Phil Sutter) [RHEL-65346]
  - json: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - doc: extend description of fib expression (Phil Sutter) [RHEL-65346]
  - tests: monitor: fix up test case breakage (Phil Sutter) [RHEL-65346]
  - src: fix extended netlink error reporting with large set elements (Phil Sutter) [RHEL-65346]
  - rule: netlink attribute offset is uint32_t for struct nlerr_loc (Phil Sutter) [RHEL-65346]
  - mnl: update cmd_add_loc() to take struct nlmsghdr (Phil Sutter) [RHEL-65346]
  - mnl: rename to mnl_seqnum_alloc() to mnl_seqnum_inc() (Phil Sutter) [RHEL-65346]
  - src: collapse set element commands from parser (Phil Sutter) [RHEL-65346]
  - libnftables-json: fix raw payload expression documentation (Phil Sutter) [RHEL-65346]
  - tests: shell: fix spurious dump failure in vmap timeout test (Phil Sutter) [RHEL-65346]
  - Rebase onto version 1.1.1 (Phil Sutter) [RHEL-65346]


author: Phil Sutter <psutter@redhat.com> [1.1.1-5.el10]
changelog:
  - src: add conntrack information to trace monitor mode (Phil Sutter) [RHEL-102994]
  - src: split monitor trace code into new trace.c (Phil Sutter) [RHEL-102994]


author: Phil Sutter <psutter@redhat.com> [1.1.1-6.el10]
changelog:
  - Makefile: Fix for 'make CFLAGS=...' (Phil Sutter) [RHEL-108851]
  - table: Embed creating nft version into userdata (Phil Sutter) [RHEL-108851]
  - doc: nft.8: Minor NAT STATEMENTS section review (Phil Sutter) [RHEL-106743]
  - trace: Fix for memleak in trace_alloc_list() error path (Phil Sutter) [RHEL-111205]


author: Jan Macku <jamacku@redhat.com> 1.60.0-1
changelog:
  - update to the latest upstream release
  - update PGP key from https://keyserver.ubuntu.com/pks/lookup?op=vindex&search=0x7e8403d5d673c366


author: Jan Macku <jamacku@redhat.com> 1.61.0-1
changelog:
  - update to the latest upstream release
  - fixes CVE-2024-28182 - HTTP/2 CONTINUATION frames can be utilized for DoS attacks


author: Joe Orton <jorton@redhat.com> - 2:1.26.2-2
changelog:
  - Add systemd instantiated service nginx@.service, allowing e.g. "systemctl
    start nginx@foobar.service" to start an instance of nginx using
    /etc/nginx/foobar.conf as the configuration.


author: Gris Ge <fge@redhat.com> - 2.2.44-1
changelog:
  - Upgrade to 2.2.44
  - Support reapply on mac-ref interface. RHEL-86035
  - Support refer route next-hop-interface by mac. RHEL-80547


author: Gris Ge <fge@redhat.com> - 2.2.46-1
changelog:
  - Upgrade to 2.2.46
  - Store DNS to both iface and global DNS. RHEL-91250
  - Support nmpolicy against down iface. RHEL-86240
  - Support removal VLAN connection with empty ifname. RHEL-92916


author: Gris Ge <fge@redhat.com> - 2.2.48-1
changelog:
  - Upgrade to 2.2.48
  - Validate OVN bridge mapping. RHEL-37922
  - Support bond `lacp_active` and `ns_ip6_target`. RHEL-1415
  - Support matching by PCI adress. RHEL-80116
  - Apply dispatch changes first. RHEL-94840
  - Fix SRIOV VF reference. RHEL-91588
  - Fix deleting with `fail_over_mac` bond. RHEL-102600


author: Rahul Rajesh <rrajesh@redhat.com> - 2.2.49-1
changelog:
  - Upgrade to 2.2.49
  - Ignore desired MAC for bonds with fail_over_mac. RHEL-106135
  - Fix setting DNS only with search or option. RHEL-102333


author: Wen Liang <wenliang@redhat.com> - 2.2.43-1
changelog:
  - Upgrade to 2.2.43
  - Support ethtool Forward Error Correction (FEC). RHEL-85673
  - Support nm connection with empty connection.interface-name. RHEL-84756


author: Gris Ge <fge@redhat.com> - 2.2.52-1
changelog:
  - Upgrade to 2.2.52
  - Support interface alternative names. RHEL-110779
  - Support IPv4 forwarding. RHEL-110788
  - Support IPSec `leftsendcert` option. RHEL-110635


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Support matching interface via PCI address. RHEL-121112
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121993


author: Gris Ge <fge@redhat.com> - 2.2.52-1
changelog:
  - Upgrade to 2.2.52
  - Support interface alternative names. RHEL-110636
  - Support IPv4 forwarding. RHEL-110789
  - Support IPSec `leftsendcert` option. RHEL-110636


author: Gris Ge <fge@redhat.com> - 2.2.57-1
changelog:
  - Upgrade to 2.2.57
  - Use global DNS even for static IP with static DNS. (RHEL-126738)
  - Add libreswan leftprotoport and rightprotoport support. (RHEL-130914)


author: Than Ngo <than@redhat.com> - 3.23.0-1
changelog:
  - 3.23.0
     * EP11: Add support for FIPS-session mode
     * Updates to harden against RSA timing attacks
     * Bug fixes


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-58996, update to 3.24.0
  - Resolves: RHEL-39004, provide opencryptoki CCA Token also on x86_64 and ppc64le
  - Resolves: RHEL-43675, openCryptoki cca token RSA OAEP v2.1 support
  - Resolves: RHEL-43674, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-43676, openCryptoki cca token SHA3 support
  - Resolves: RHEL-24036, support protected keys for extractable keys


author: Than Ngo <than@redhat.com> - 3.24.0-5
changelog:
  - Use systemd-sysusers
  - Modifie the unit file to change file ownership
  - opencryptoki doesn't work in image mode
    Resolves: RHEL-77146


author: Than Ngo <than@redhat.com> - 3.24.0-7
changelog:
  - Resolves: RHEL-80632, tokens are deleted on reboot
  - Related: RHEL-77146, opencryptoki doesn't work in image mode


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-85376, ep11 token: PKCS #11 3.0 - support SHA3
  - Resolves: RHEL-90589, CCA token: basic support of AES-GCM
  - Resolves: RHEL-72964, cca token support cipher keys
  - Resolves: RHEL-72968, Support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-73343, Upgrade openCryptoki to latest version
  - Resolves: RHEL-75144, p11kmip: a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75761, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85374, cca token: Support ECDH to derive AES keys


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73343, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77146, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104598


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-74
changelog:
  - Use %{buildroot} instead of $RPM_BUILD_ROOT as it is more recent
  - Use directory macros and push/popd


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-75
changelog:
  - Fix installation on OSTree by removing %ghost (rhbz#2193429)
  - Remove %ldconfig_postun as it has no effect in Fedora


author: Ondrej Sloup <osloup@redhat.com> - 1.3.2-77
changelog:
  - Sync the RHEL version and Fedora version of the specfile
  - Update sources file and config.{sub|guess}
  - Skip verification for .soc file as it will change after install


author: Fedora Release Engineering <releng@fedoraproject.org> - 1.3.1-12
changelog:
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
  - Fix build in all arches, copied from Debian
  - Run autoreconf to make sure that autotools are updated
  - Clean up some trailing white spaces


author: Alan Steinberg <alan.steinberg@oracle.com> - 10.1-1.0.3
changelog:
  - Updated released notes for OL10.1 GA.
  - Updated SWID tags for OL10.1 GA.
  - Updated /var/lib/supportinfo to show correct minimum RAM value [Orabug: 38637697]


author: Joseph Marrero Corchado <jmarrero@redhat.com> - 2025.2-1
changelog:
  - Rebase to ostree 2025.2 Backport
    https://github.com/ostreedev/ostree/pull/3473 Backport
    https://github.com/ostreedev/ostree/pull/3472


author: Brian C. Lane <bcl@redhat.com> - 3.5-11
changelog:
  - parted: Fix ending sector location when using kibi IEC suffix (bcl)
  - tests: Fix formatting and snprintf warnings in tests. (bcl)
  - ui: Add checks for prompt being NULL (bcl)
  - strlist: Handle realloc error in wchar_to_str (bcl)
  - libparted: Fix potential NULL dereference in ped_disk_next_partition (bcl)
  - filesys: Check for null from close_fn (bcl)


author: Brian C. Lane <bcl@redhat.com> - 3.5.28-1
changelog:
  - Upstream 3.5.28 Alpha release
  - Dropped all patches included in new upstream release
  - Bumped minor version on libparted.so and libparted-fs-resize.so


author: Brian C. Lane <bcl@redhat.com> - 3.6-7
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73220
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73220
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73220
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73220


author: Gulam Mohamed <gulam.mohamed@oracle.com> - 3.6-7.0.1
changelog:
  - Fix race between systemd and parted command [Orabug: 38651793]
  - Add test to detect race between parted and systemd


author: Nathan Scott <nathans@redhat.com> - 6.3.2-1
changelog:
  - Align start of PCP services with systemd presets (RHEL-22723)
  - Improved pcp-xsos command line error diagnostics (RHEL-56836)
  - Fix buffer sizing checks in pmstore PDU handling (RHEL-57795)
  - Guard against symlink attacks in pmpost program (RHEL-57797)
  - Update to latest stable version of PCP (RHEL-62801)


author: Mohith Kumar Thummaluru <mohith.k.kumar.thummaluru@oracle.com> - 6.3.7-1.0.2
changelog:
  - Add support for rocestat pmda [Orabug: 38109270]
  - Add support for rocestat client [Orabug: 38109292]


author: Sourav Sharma <sourav.ss.sharma@oracle.com> 6.3.7-1.0.4
changelog:
  - Backports various pcp bugs and enhancements  [Orabug: 35778072]
  - [Orabug: 36932629] [Orabug: 37655753] [Orabug: 38435551]
  - [Orabug: 38380185] [Orabug: 38526634]


author: Nathan Scott <nathans@redhat.com> - 6.3.7-5
changelog:
  - Make pcp-zeroconf start enabled services once again (RHEL-93182)
  - Fix python PMDA wrapper handling of list objects
  - Improve tmpfiles.d handling of empty directories
  - Backport some more fixes to the OpenMetrics PMDA
  - Fix a multilib regression in PCP header files


author: EL Errata <el-errata_ww@oracle.com> - 6.3.7-5.0.1
changelog:
  - Fixes build issues due to patch 1002 applying error [Orabug: 38288886]
  - Add support for rocestat pmda [Orabug: 38109270]
  - Add support for rocestat client [Orabug: 38109292]


author: Paul Howarth <paul@city-fan.org> - 2.14-1
changelog:
  - Update to 2.14 (rhbz#2161420)
    - Remove Test::Fatal and Test::Needs from test prereqs (GH#7, GH#8)
  - Use SPDX-format license tag


author: Jitka Plesnikova <jplesnik@redhat.com> - 1.227-1
changelog:
  - Update to 1.227
    - New maintainer, GTERMARS
    - Add basic GitHub Actions setup for testing
    - Typo corrections in POD
    - Eliminated use of state/node files in temp directory


author: Paul Howarth <paul@city-fan.org> - 0.14-21
changelog:
  - Use SPDX-format license tag
  - Use author-independent source URL
  - Drop redundant buildroot cleaning in %install section
  - Drop support for old Perl versions needing XS helper


author: Michal Josef Špaček <mspacek@redhat.com> - 6.16-1
changelog:
  - 6.16 bump
  - Fix minimal version of IO::Socket::IP
  - Fix requires/provided modules in *tests package


author: Paul Howarth <paul@city-fan.org> - 1.18-1
changelog:
  - Update to 1.18 (rhbz#2251844)
    - Address Freebsd build issue: make function checks more robust within
      shared lib (GH#35)


author: Paul Howarth <paul@city-fan.org> - 1.20-1
changelog:
  - Update to 1.20 (rhbz#2256127)
    - Remove --no-undefined from compiler test, which is not compatible with all
      platforms (GH#37)
    - Skip t/pty_get_winsize.t tests on AIX (GH#32)
    - Fix patchlevel check for util.h (GH#27)


author: Paul Howarth <paul@city-fan.org> - 20231003.0-1
changelog:
  - Update to 20231003.0 (rhbz#2241845)
    - On Windows, avoid hang under IPCRUNDEBUG (GH#157)
    - Refresh "cpanfile" from Makefile.PL, to allow use on Windows
    - Normalize shebangs to /usr/bin/perl (GH#163)
    - Fix or skip all tests recently seen to fail on Windows
    - Include t/result.t in releases
    - Make full_result() and result() Windows behavior match non-Windows (GH#168)


author: Paul Howarth <paul@city-fan.org> - 0.142-1
changelog:
  - Update to 0.142
    Deprecations
    - Tilde expansion is deprecated due to inconsistent and bug-prone behavior
    Bug fixes
    - Prevent expansion of tildes that are not the very first character (e.g.
      "./~foo")
    - Prevent unintentional tilde expansion during internal path processing
    - Escape non-tilde glob characters before tilde expansion
    - Fixed spew/edit to a long filename approaching the filesystem length limit
    - Internal calls to 'print' are checked for possible errors
    - Internal read calls are checked for errors
    Changes
    - Path stringification now adds "./" in front of paths starting with literal
      tilde so they will round-trip; FREEZE updated to use this stringification
      rule as well
    - 'move' now uses File::Copy::move internally instead of the built-in
      'rename', allowing it to work across filesystems; it also returns an object
      for the moved location, allowing chaining
    - edit_lines_raw now uses a buffered raw I/O layer
    - edit_lines_utf8 now prefers PerlIO::utf8_strict, if available
    - lines_utf8 now consistently uses a buffered I/O layer
    - open*_utf8 now prefers PerlIO::utf8_strict, if available
    - slurp_utf8 now consistently uses an unbuffered I/O layer
    Documented
    - Changed all raw/UTF-8 layer descriptions in method documentation to match
      the code
    - Fixed SYNOPSIS syntax
    - Documented how to disable TMPDIR when making temp files/dirs
    Testing
    - Add additional tilde stringification testing
    - Fixed tilde expansion tests on Windows
    - Skip a problematic test case on Cygwin


author: Michal Josef Špaček <mspacek@redhat.com> - 1.65-4
changelog:
  - Rewrite to use of /builddir/build/BUILDROOT/perl-Pod-Parser-1.67-5.el10.x86_64 macro
  - Update license to SPDX format


author: Paul Howarth <paul@city-fan.org> - 0.001013-21
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Drop support for building with Test::More < 0.88
    - Drop redundant buildroot cleaning in %install section
    - Use %license unconditionally


author: Paul Howarth <paul@city-fan.org> - 0.03-48
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Specify all dependencies
    - Fix permissions verbosely
    - Simplify find commands using -empty and -delete
    - Make %files list more explicit


author: Paul Howarth <paul@city-fan.org> - 1.202-1
changelog:
  - Update to 1.202 (rhbz#2158345)
    - Converted to Dist::Zilla
    - Test::Deep will now require v5.12, and this may go up; this change allows
      simplification of the Makefile.PL, which was coping with a mistake made
      twelve years ago
  - Use SPDX-format license tag
  - Package LICENSE file


author: Paul Howarth <paul@city-fan.org> - 1.204-1
changelog:
  - Update to 1.204 (rhbz#2159015)
    - Try to avoid clobbering global error variables when loading test libraries
    - hash_each now enumates keys in sort() order, to make errors more consistent


author: Paul Howarth <paul@city-fan.org> - 0.7000-1
changelog:
  - Update to 0.70
    - Stop pointless use of taint-mode in tests, so tests pass when perl is
      built without taint support


author: Paul Howarth <paul@city-fan.org> - 0.7100-1
changelog:
  - Update to 0.71
    - Document and test different behavior regarding Booleans in perl 5.38.0
      compared to earlier versions (GH#21)


author: Paul Howarth <paul@city-fan.org> - 0.43-23
changelog:
  - Spec tidy-up
    - Use SPDX-format license tag
    - Use author-independent source URL
    - Fix permissions verbosely
    - Simplify find command using -delete


author: Paul Howarth <paul@city-fan.org> - 0.032-1
changelog:
  - Update to 0.032
    - New config variable, $ENV{PERL_TEST_WARNINGS_ONLY_REPORT_WARNINGS}, for
      temporarily turning failures into reports


author: Paul Howarth <paul@city-fan.org> - 0.033-1
changelog:
  - Update to 0.033
    - Add Test2 compatibility in the test triggered by done_testing()
    - New long-awaited feature (!!!) "allow_patterns", to either
      temporarily or globally exempt particular warning patterns


author: Jindrich Novy <jnovy@redhat.com> - 6:5.2.2-1
changelog:
  - stick to v5.2-rhel upstream branch for RHEL
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/458f9b4)
  - Related: RHEL-58990


author: Jindrich Novy <jnovy@redhat.com> - 6:5.2.2-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/e40738b)
  - Resolves: RHEL-61858


author: EL Errata <el-errata_ww@oracle.com> - 5.4.0-1.0.1
changelog:
  - Add devices on container startup, not on creation
  - overlay: Put should ignore ENINVAL for Unmount [Orabug: 36234694]
  - Drop nmap-ncat requirement and skip ignore-socket test case [Orabug: 34117404]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 5.4.0-1.0.2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/0ee1d49) [Orabug: 37995432]


author: Alex Burmashev <alexander.burmashev@oracle.com> - 6:5.4.0-10
changelog:
  - rebuild to resolve CVE-2025-22871
  - Pick latest f rom https://github.com/containers/podman/tree/v5.4-rhel
    https://github.com/containers/podman/commit/0ee1d49


author: Craig Guiller <craig.guiller@oracle.com> - 6:5.4.0-12
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9811294)
  - fixes "CVE-2025-6032 podman: podman missing TLS verification [rhel-9.6.z]"
  - Resolves: RHEL-96708


author: Jindrich Novy <jnovy@redhat.com> - 6:5.4.0-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/b0d88c7)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-9.6.z]"
  - Resolves: RHEL-113152


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/7078b79)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-10.1]"
  - Resolves: RHEL-113140


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/c5a3735)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 10.1] 0day"
  - Resolves: RHEL-110318


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/61231e1)
  - fixes "Timeouts while pushing Sigstore logs to Rekor - [RHEL 10.1] 0day"
  - Resolves: RHEL-111077


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/2791007)
  - fixes "[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-10.1.z]"
  - Resolves: RHEL-126635


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/3bf5313)
  - fixes "run 1.2.x upgrade throws error while using nocopy volume mount filesystem option - [RHEL 10.1]"
  - Resolves: RHEL-132532


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/a58af02)
  - fixes "Bump to runc v1.2.9 or v1.3.4 to get CVE and regression fixes - Podman [rhel-10.1.z]"
  - Resolves: RHEL-132825


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/0a20b84)
  - fixes "CVE-2025-47913 podman: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-10.1.z]"
  - Resolves: RHEL-134778


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/b194cd9)
  - fixes "podman build system test easily failed with TIMEOUT"
  - Resolves: RHEL-138650


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald"
  - Related: RHEL-109790


author: Jindrich Novy <jnovy@redhat.com> - 7:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL10.1 packaging"
  - Related: RHEL-80817


author: Filip Janus <fjanus@redhat.com> - 16.10-2
changelog:
  - Add OpenSSL support to upgrade_configure function
  - This ensures upgrade server is compiled with OpenSSL support
  - Required for SSL/TLS connections during database upgrades


author: Filip Janus <fjanus@redhat.com> - 16.10-3
changelog:
  - Add tmpfiles.d configuration for PostgreSQL 16
  - Ensures proper directory permissions for /var/lib/pgsql


author: Benjamin A. Beasley <code@musicinmybrain.net> - 3.19.6-3
changelog:
  - Remove unnecessary explicit pkgconfig dependencies
  - Remove an obsolete workaround for failing Java tests
  - Remove conditionals for retired 32-bit ARM architecture
  - Remove a slow-test workaround on s390x
  - Reduce macro indirection in the spec file


author: Miro Hrončok <mhroncok@redhat.com> - 1.12.1-1
changelog:
  - Add a temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Related: rhbz#2284187


author: Miro Hrončok <mhroncok@redhat.com> - 1.13.0-1
changelog:
  - Properly escape weird characters from paths in %{pyproject_files} (RPM 4.19+ only)
  - Revert the temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Fixes: rhbz#1990879


author: Python Maint <python-maint@redhat.com> - 1.15.0-1
changelog:
  - Add a possibility to read runtime requirements from pyproject.toml [project] table
  - Fixes: rhbz#2261939
  - Don't generate a dependency on pip when %pyproject_buildrequires -N is used
  - Fixes: rhbz#2294510
  - Even when %_auto_set_build_flags is disabled, set all compiler flags when building wheels
  - Fixes: rhbz#2293616


author: Miro Hrončok <mhroncok@redhat.com> - 1.16.0-1
changelog:
  - %pyproject_buildrequires: Add support for dependency groups (PEP 735), via the -g flag
  - This is implied when used tox testenvs depend on dependency groups (requires tox 4.22+)
  - Fixes: rhbz#2318849


author: Miro Hrončok <miro@hroncok.cz> - 1.16.1-1
changelog:
  - Support for setuptools 70+
  - wheel is no longer generated as a dependency of the default build system


author: Miro Hrončok <mhroncok@redhat.com> - 7.4.1-1
changelog:
  - Update to 7.4.1
  - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-1-2023-09-02
  - Fixes: rhbz#2236995


author: Miro Hrončok <mhroncok@redhat.com> - 7.4.2-1
changelog:
  - Update to 7.4.2
  - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-2-2023-09-07
  - Fixes: rhbz#2237942


author: Miro Hrončok <mhroncok@redhat.com> - 7.4.3-1
changelog:
  - Update to 7.4.3
  - Changelog: https://docs.pytest.org/en/stable/changelog.html#pytest-7-4-3-2023-10-24
  - Fixes: rhbz#2245983


author: Miro Hrončok <mhroncok@redhat.com> - 3.8.0-3
changelog:
  - Fork python-flit-core from the python-flit package
  - Adjust the License tag to include flit_core/versionno.py's regex (BSD-2-Clause)


author: Karolina Surma <ksurma@redhat.com> - 1.4.1-5
changelog:
  - License verified according to the SPDX specification
    https://fedoraproject.org/wiki/Changes/SPDX_Licenses_Phase_2


author: Miro Hrončok <mhroncok@redhat.com> - 3.1.5-1
changelog:
  - Update to 3.1.5
  - Security fix for CVE-2024-56201
  - Security fix for CVE-2024-56326
  Resolves: RHEL-73095


author: Miro Hrončok <mhroncok@redhat.com> - 1:7.2.6-2
changelog:
  - Weaken the runtime dependency on:
    - python3-sphinxcontrib-applehelp
    - python3-sphinxcontrib-devhelp
    - python3-sphinxcontrib-jsmath
    - python3-sphinxcontrib-htmlhelp
    - python3-sphinxcontrib-serializinghtml
    - python3-sphinxcontrib-qthelp
  - Packages that want to use them during build need to BuildRequire them explicitly


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.8-1
changelog:
  - Update to 3.12.8
  - Security fix for CVE-2024-9287 and CVE-2024-12254
  Resolves: RHEL-64877, RHEL-70450


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-90555


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98060, RHEL-98047, RHEL-97813, RHEL-98062, RHEL-98180


author: Akshata Konala <akshata.konala@oracle.com> - 3.12.9-2.2
changelog:
  - Enable PAC and BTI protections for aarch64
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-7
changelog:
  - Sync with Fedora:
    - fix directory ownership
    - install cmake modules for plugins
    - depend on pkgconfig(egl) rather than mesa-libEGL-devel
    Resolves: RHEL-73681


author: Jan Grulich <jgrulich@redhat.com> - 6.8.1-2
changelog:
  - Make -devel subpkg to require qtbase-private-devel for cmake >= 3.31.0
    Workaround for rhbz#2330219
    Resolves: RHEL-53982


author: RHEL Packaging Agent <jotnar@redhat.com> - 6.9.1-2.2
changelog:
  - Fix CVE-2025-10728: Replace quadratic cycle check with linear recursion
    guard to prevent stack overflow
    Resolves: RHEL-119719


author: Jun Aruga <jaruga@redhat.com> - 3.3.1-5
changelog:
  - Upgrade to Ruby 3.3.1.
    Resolves: RHEL-33975
  - Fix buffer overread vulnerability in StringIO.
    Resolves: RHEL-34124
  - Fix RCE vulnerability with .rdoc_options in RDoc.
    Resolves: RHEL-34116
  - Fix arbitrary memory address read vulnerability with Regex search.
    Resolves: RHEL-33866


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-7
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-59035
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57047
    Resolves: RHEL-57059
    Resolves: RHEL-57070
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-52802


author: Jun Aruga <jaruga@redhat.com> - 3.3.7-9
changelog:
  - Upgrade to Ruby 3.3.7
    Resolves: RHEL-77994
  - Fix Ruby OpenSSL to respect crypto-policies TLS minimal version.
    Resolves: RHEL-21019


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-10
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-87342
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86116
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-11
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-130160
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-122028


author: Yaakov Selkowitz <yselkowi@redhat.com> - 0.5.5-4
changelog:
  - Adapt tests to mariadb 10.11
  - Avoid rubygem-eventmachine build dependency in RHEL
  - Adapt tests to openssl 3.2


author: Timm Bäder <tbaeder@redhat.com> - 2.2.8-21
changelog:
  - Add downstream patch to fix c99 incompatibilities
  - https://fedoraproject.org/wiki/Changes/PortingToModernC


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.3-1
changelog:
  - Allow svirt read virtqemud fifo files
  Resolves: RHEL-104069
  - Allow virtqemud handle virt_content_t chr files
  Resolves: RHEL-76104
  - Allow "hostapd_cli ping" run as a systemd service
  Resolves: RHEL-77047
  - All sblim-sfcbd the dac_read_search capability
  Resolves: RHEL-98287
  - Allow sblim domain read systemd session files
  Resolves: RHEL-98287
  - Allow sblim-sfcbd execute dnsdomainname
  Resolves: RHEL-98287
  - Allow systemd-importd create and unlink init pid socket
  Resolves: RHEL-98490


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.4-1
changelog:
  - Allow systemd-coredump the sys_chroot capability
  Resolves: RHEL-97586
  - Add the rhcd_rw_fifo_files() interface
  Related: RHEL-99318
  - Add insights_client_delete_lib_dirs() interface
  Related: RHEL-99318


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.5-1
changelog:
  - Confine nfs-server generator
  Resolves: RHEL-106119
  - Support virtqemud handle hotplug hostdev devices
  Resolves: RHEL-65266
  - Allow virtstoraged create qemu /var/run files
  Resolves: RHEL-104344
  - Allow virtqemud write to sysfs files
  Resolves: RHEL-104378
  - Allow unconfined_domain_type cap2_userns capabilities
  Resolves: RHEL-93656


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.6-1
changelog:
  - Apply generator template to selinux-autorelabel generator
  Resolves: RHEL-107516
  - Allow systemd-coredumpd capabilities in the user namespace
  Resolves: RHEL-97586
  - Allow virtqemud start a vm which uses nbdkit
  Resolves: RHEL-69118
  - Add nbdkit_signal() and nbdkit_signull() interfaces
  Resolves: RHEL-69118
  - Allow openvswitch read virtqemud process state
  Resolves: RHEL-65322
  - Add binsbin-convert.sh script
  Resolves: RHEL-69118


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.7-1
changelog:
  - Revert "Add policy for insights-core"
  Resolves: RHEL-110651
  - Revert "Add insights_core interfaces"
  Resolves: RHEL-110651


author: Pooja Senthil Kumar <pooja.senthil.kumar@oracle.com>- 42.1.7-1.0.1
changelog:
  - Allow systemd_fstab_generator_t to read udev pid files [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to read sysfs filesystem [Orabug: 37139639]
  - Allow systemd_fstab_generator_t to get attributs of fixed_disk_device_t and
    removable_device_t [Orabug: 37139639]
  - Change reference in /etc/selinux/config to point to Oracle doc [Orabug: 36899915]
  - Allow user_mail_domain to manage exim_log_t and exim_spool_t link files [Orabug: 36617121]
  - Allow exim_t to read exim_log_t and manage exim_spool_t link files [Orabug: 36430005]
  - Make import-state work with mls policy [Orabug: 32636699]
  - Add map permission to lvm_t on lvm_metadata_t. [Orabug: 31405325]
  - Add comment for map on lvm_metadata_t. [Orabug: 31405325]
  - Make cloud-init work with mls policy [Orabug: 32430460]
  - Allow systemd-pstore to transfer files from /sys/fs/pstore [Orabug: 31594666]
  - Make lsmd and rngd work with mls policy [Orabug: 31405378]
  - Allow virt_domain to mmap virt_content_t files [Orabug: 30932671]
  - Add vhost-scsi to be vhost_device_t type [Orabug: 27774921]
  - Allow ocfs2_dlmfs to be mounted with ocfs2_dlmfs_t type. [Orabug: 13333429]


author: Ilya Okomin <ilya.okomin@oracle.com> - 42.1.7-1.0.2
changelog:
  - Fix specfile triggers for fapolicyd and usbguard DSP modules [Orabug: 38681740] [Orabug: 38579739]


author: Tomas Bzatek <tbzatek@redhat.com> - 1.48-7
changelog:
  - udev rules: avoid spurious warning for non-SCSI devices (RHEL-40861,RHEL-54607)
  - Install missing 00-scsi-sg3_config.rules
  - Fix file references to other udev rules


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.14.0-5
changelog:
  - passwd: Provide binary from this package. Enable libpam and
    disable account-tools-setuid. Provide passwd PAM service file.
    Resolves: #2233275
  - passwd: provide --stdin option


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-1
changelog:
  - Rebase to version 4.15.0
  - getdef: avoid spurious error messages about unknown configuration options


author: Javier Martinez Canillas <javierm@redhat.com> - 15-3
changelog:
  - Make EFI variable copying fatal only on secureboot enabled systems
    Resolves: rhbz#1704854
  - Fix booting shim from an EFI shell using a relative path
    Resolves: rhbz#1717063


author: Ilya Okomin <ilya.okomin@oracle.com> - 16.1-2.0.1.el10
changelog:
  - Update shim to upstream v16.1 [Orabug: 38397604]
  - Update Oracle sbat metadata and vendor certificates [Orabug: 38397604]


author: Andreas Schneider <asn@redhat.com> - 1.4.0-1
changelog:
  - Update to version 1.4.0
    * https://gitlab.com/cwrap/socket_wrapper/-/blob/socket_wrapper-1.4.0/CHANGELOG


author: Lukas Tyrychtr <ltyrycht@redhat.com>
changelog:
  - Conditionalize the festival subpackage, we're not shipping Festival in RHEL 10
   Festival in RHEL 10)


author: Jitka Plesnikova <jplesnik@redhat.com> - 4.2.1-1
changelog:
  - Resolves: RHEL-32325
  - 4.2.1 bump
  - Fix gcc's -Wformat-security warning in R Raise function
  - OCaml 5.2.0 ppc64le fix
  - Add support for Python 3.13


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 7.0.2-2
changelog:
  - Fix possible use of an undefined value as an ARRAY reference in ParserNonXS.pm
    (causes FTBFS of a2ps)
    Resolves: #2171433


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 7.1-4
changelog:
  - Fix memory/resource leaks, insufficient memory allocations and
    variable declarations without initializer
    Resolves: RHEL-43595


author: Than Ngo <than@redhat.com> - 12:20230311-18
changelog:
  - Fixed eufm font mapping
  - Added missing license and fixed file list in texlive-plain
  Related: RHEL-34826


author: Than Ngo <than@redhat.com> - 13:20240311-2
changelog:
  - removed obsoleted patch
  - fixed file conflicts in bibtex, oberdiek, xetex, attachfile, xepersian
  - fixed texlive-docindex conflict with texlive-base
  Related: RHEL-59868
  Resolves: RHEL-53483, RHEL-53786


author: Than Ngo <than@redhat.com> - 13:20240311-3
changelog:
  - include luajit for x86_64 only as it only supports this arch
  - fix requirement on tex-kpathsea, texlive-base
  - fix unicode issues
  - add rpminspect.yaml

  Related: RHEL-59868


author: Than Ngo <than@redhat.com> - 13:202403
changelog:
  - Add two subpackages for texlive 2024: firstaid, hypcap
    can't find latex2e-first-aid-for-external-files.ltx file
  - Drop luajittex
  Resolves: RHEL-65862


author: Than Ngo <than@redhat.com> - 13:20240311-6
changelog:
  - Resolves: RHEL-70243, remove xdvi due to removal of X11 in ghostscript
  - Resolves: RHEL-69757, fix python-sphinx FTBFS


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.14.1-75
changelog:
  - Add epoch prefix to version-release in requires
  - Add rpminspect.yaml to adjust configuration for rpminspect run
    Resolves: RHEL-56884


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-77
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-86503
  - Remove deprecated path from systemd service file
    Resolves: RHEL-86502


author: Andreas Schneider <asn@redhat.com> - 1.3.0-1
changelog:
  - Update to version 1.3.0
    o https://gitlab.com/cwrap/uid_wrapper/-/blob/uid_wrapper-1.3.0/CHANGELOG


author: Jens Petersen <petersen@redhat.com> - 15.1.0-0.1
changelog:
  - update to draft 15.1.0: https://unicode.org/versions/Unicode15.1.0/
  - do not add copyright.html file from website
  - add missing Unicode-TOU license tag


author: Packit <hello@packit.dev> - 2.3.12-1
changelog:
  - New Release 2.3.12 (lurcher)
  - Don't check state with shared env (lurcher)
  - Add --enable-singleenv option (lurcher)
  - Allow longer messages via SQLGetDiag (lurcher)
  - Add --enable-utf8ini flag and coding (lurcher)
  - Fix possible seg faults with SQLAPI and pooling (lurcher)
  - Fix possible seg faults with SQLAPI and pooling (lurcher)
  - Remove self-reference (Stefan)
  - Avoid implicit function declarations, for C99 compatibility (Florian Weimer)
  - Fix --enable-stats config error (lurcher)
  - Allow diagnostics to be retrieved on SQL_NO_DATA (Kevin Adler)
  - isql.1: Add information about passwords containing semicolons (Hugh McMaster)
  - isql.1: Various text updates (Hugh McMaster)
  - Export __clear_ini_cache from libodbcinst (lurcher)
  - Revert "Add call to atexit to clear the ini cache" (lurcher)
  - Add call to atexit to clear the ini cache (lurcher)
  - Add extra iusql connectionstring syntax (lurcher)
  - Allow longer connection strings (part 3) (lurcher)
  - Allow longer connection strings (part 2) (lurcher)
  - Allow longer connection strings (lurcher)
  - Fixed Connection String (Stefan)
  - Add extra connection syntax to isql help (lurcher)
  - Add extra logging for ODBCINST connect settings (lurcher)
  - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (and report warning) (lurcher)
  - Allow isql to handle SQLPrepare returning SQL_SUCCESS_WITH_INFO (lurcher)
  - Allow passing complete connection string into iusql (lurcher)
  - Remove __get_connection from cursor lib (lurcher)
  - Avoid failed build if clock_gettime() is not available (lurcher)
  - Update change log (lurcher)
  - DriverManager/_info.c: Get locale encoding on Windows. (Markus Mützel)
  - DriverManager/drivermanager.h: fix build without threads (Fabrice Fontaine)
  - Fix iconv handle leak with pooling (lurcher)
  - Fix buffer overrun (lurcher)
  - Create SECURITY.md (Nick Gorham)
  - Move to 2.3.12pre (lurcher)
  - Makefile.am: Do not install config.h (Hugh McMaster)


author: Kate Hsuan <hpa@redhat.com> - 1.90.6-1
changelog:
  - Update to upstream version 1.90.6
  - Update to the upstream version 1.90.6
  - Include a fix patch for "incorrect external device battery update" issue.
    Link: https://gitlab.freedesktop.org/upower/upower/-
    /commit/7d7bb84fde91bef9ee7eba924cbdfa74639cc4fe


author: Kate Hsuan <hpa@redhat.com> - 1.90.8-1
changelog:
  - Update to the upstream version 1.90.8
  - Update to 1.90.8
  - README and HACKING were renamed to README.md and HACKING.md
  - Support zsh-completion
  - Resolve memory leak when connecting/disconnecting and refreshing the
    battery info.


author: Sérgio Basto <sergio@serjux.com> - 1.6.2-61
changelog:
  - Use standard Fedora linker flags (bug #1548666)
    https://src.fedoraproject.org/rpms/uuid/pull-request/1


author: Ingvar Hagelund <ingvar@redpill-linpro.com> - 7.4.2-1
changelog:
  - New upstream release. A security release
  - Includes fix for CVE-2023-44487 aka VSV00013, rhbz#2243328, HTTP/2 Rapid Reset Attack


author: Luboš Uhliarik <luhliari@redhat.com> - 7.6.0-3
changelog:
  - Resolves: RHEL-59267 - varnish rebase to 7.6.0
  - Resolves: RHEL-30333 CVE-2024-30156 varnish: HTTP/2 Broken Window
    Attack may result in denial of service


author: Jonathon Jongsma <jjongsma@redhat.com> - 4.1.0-7
changelog:
  - cloner: Sync <uuid> and <sysinfo> system uuid (RHEL-34608)
  - virtinstall: fix regression with --boot and no install method (RHEL-34608)
  - progress: Fix showing correct final total (RHEL-34608)
  - virtinstall: Fix the allocating disk size printed by the progress bar (RHEL-34608)
  - virtinstall: Hide total_size in the progress bar if it doesn't need (RHEL-34608)
  - virt-install: Recommend '--boot uefi' (RHEL-34608)
  - virt-install: Document Secure Boot setups (RHEL-34608)
  - tests: Add more cloud-init and TPM test cases (RHEL-34608)
  - installer: drop default TPM for --cloud-init install phase (RHEL-34608)
  - Add gating for centos stream 10 (RHEL-34608)
  - xmleditor: make gtksourceview optional (RHEL-35859)


author: Pavel Hrdina <phrdina@redhat.com> - 5.0.0-1
changelog:
  - Rebased to virt-manager-5.0.0 (RHEL-46783)
  - The rebase also fixes the following bugs:
      RHEL-50653, RHEL-65105, RHEL-62960, RHEL-46282, RHEL-65371
      RHEL-65189, RHEL-66768


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-4
changelog:
  - Rebase to virt-v2v 2.7.1
    resolves: RHEL-56814
  - Replace Jansson with json-c
    resolves: RHEL-65297
  - Find drivers for win2025 guests
    resolves: RHEL-65009
  - in-place: Add new -O option to write inspector XML
    resolves: RHEL-70538
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-78505
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-78657


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-9
changelog:
  - Rebase to virt-v2v 2.8.1
    related: RHEL-81735
  - Fix virt-v2v -v --install dnf5 error
    resolves: RHEL-83288
  - Print blkhash of converted image in virt-v2v debugging output
    resolves: RHEL-85514
  - Document dracut network-legacy conversion failure
    resolves: RHEL-55732
  - Print nbdcopy command in debug output
    resolves: RHEL-86088
  - Remove usage of nbdkit-cacheextents-filter
    resolves: RHEL-88860
  - Print better mountpoint stats in debug output
    resolves: RHEL-88862
  - Remove several ancient, deprecated options
    resolves: RHEL-88867
  - virt-v2v-inspector is failing on snapshots of running VMs
    resolves: RHEL-88544
  - Add virt-v2v-open tool
    resolves: RHEL-89993
  - Run filesystem check before and after conversion
    resolves: RHEL-91931
  - virt-v2v fails to convert XFS guest with dirty filesystem
    resolves: RHEL-95365
  - virt-v2v fails to convert guests with e2fsck errors
    resolves: RHEL-97600
  - Improve layout of man page
    resolves: RHEL-99745
  - Fix xfs_repair out of memory error
    resolves: RHEL-99313
  - Remove virt-v2v -io vddk-noextents=true option
    resolves: RHEL-102619
  - Add -o kubevirt -oo disk and -oo create options
    resolves: RHEL-101599
  - Fix escaping of nbdkit-vddk-plugin export parameter
    resolves: RHEL-102734
  - Fix installation of drivers on firstboot with pending reboots
    resolves: RHEL-103356
  - Log the version of libnbd / nbdcopy in virt-v2v output
    resolves: RHEL-104018
  - Fix SELinux relabelling in Linux split-/usr
    resolves: RHEL-109130
  - Set boot order for Linux guests based on grub location
    resolves: RHEL-108991


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-10
changelog:
  - Fix setting boot order for Linux BIOS guests
    resolves: RHEL-108991
  - Set boot order for guests in -o kubevirt output mode
    resolves: RHEL-110742


author: EL Errata <el-errata_ww@oracle.com> - 2.8.1-13.0.1
changelog:
  - Replaced bugzilla.oracle.com references [Orabug: 34202300]
  - replaced upstream references [Orabug:34089586]


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.8.1-15
changelog:
  - v2v can't convert guest with multiple windows OS on rhel10
  - Add runtime requires for nbdkit-1.44.1-3.el10_1
    resolves: RHEL-137304


author: Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-1
changelog:
  - Resolves: RHEL-69442 - Rebase wireshark to 4.4.2
  - Resolves: RHEL-68453 - Loop with Unreachable Exit Condition ('Infinite Loop') in Wireshark
  - Resolves: RHEL-68452 - Buffer Over-read in Wireshark


author: Michal Ruprich <mruprich@redhat.com> - 1:4.4.2-2
changelog:
  - Resolves: RHEL-80274 - Uncontrolled Recursion in Wireshark
  - Resolves: RHEL-93153 - wireshark-cli's %post uses /usr/bin/udevadm but missing systemd-udev


author: Tomas Halman <thalman@redhat.com> - 1.2.39-1
changelog:
  - Resolves: RHEL-46771
    Rebase to version 1.2.39
    Fix openssl engine dependency
    Stop building gcrypt and gnutls implementations


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.1-4
changelog:
  - Remove unneeded build dependencies on xorg-x11-util-macros and libXpm
  - Remove unneeded build dependency on wayland-eglstream-protocols (RHEL-66317)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-2
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505),
                 CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511),
                 CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512),
                 CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516)


author: Tomas Pelka <tpelka@redhat.com> - 24.1.5-3
changelog:
  Rebuild for 10.0.z required due to issue when releasing original erratum.
  - CVE fix for: CVE-2025-26594 (RHEL-80504), CVE-2025-26595 (RHEL-80505),
                 CVE-2025-26596 (RHEL-80510), CVE-2025-26597 (RHEL-80511),
                 CVE-2025-26598 (RHEL-80513), CVE-2025-26599 (RHEL-80512),
                 CVE-2025-26600 (RHEL-80517), CVE-2025-26601 (RHEL-80516)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97129), CVE-2025-49176 (RHEL-97135),
                 CVE-2025-49177 (RHEL-97141), CVE-2025-49178 (RHEL-97147),
                 CVE-2025-49179 (RHEL-97153), CVE-2025-49180 (RHEL-97159)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-2
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79127), CVE-2025-26595 (RHEL-79131),
                 CVE-2025-26596 (RHEL-79142), CVE-2025-26597 (RHEL-79144),
                 CVE-2025-26598 (RHEL-79145), CVE-2025-26599 (RHEL-79147),
                 CVE-2025-26600 (RHEL-79155), CVE-2025-26601 (RHEL-79151)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97130), CVE-2025-49176 (RHEL-97136),
                 CVE-2025-49177 (RHEL-97142), CVE-2025-49178 (RHEL-97148),
                 CVE-2025-49179 (RHEL-97154), CVE-2025-49180 (RHEL-97160)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119964), CVE-2025-62230 (RHEL-120013),
                 CVE-2025-62231 (RHEL-125006)


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.5-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119965), CVE-2025-62230 (RHEL-120014),
                 CVE-2025-62231 (RHEL-125004)


author: José Expósito <jexposit@redhat.com> - 1.20.0-6
changelog:
  - Rebuilt to include the package in CRB. See:
    https://bugzilla.redhat.com/show_bug.cgi?id=2309121
    https://issues.redhat.com/browse/RHEL-57593
    https://issues.redhat.com/browse/ENGCMP-4434


author: Jakub Martisko <jamartis@redhat.com> - 0.13.78-2
changelog:
  - Fix directory traversal in unzip binary
  - Disable the CVE tests during the check phase - the reproducers for these are downloaded from the github
  - Resolves: RHEL-105822


