# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.11.1.el8_10]
changelog:
  - x86/bugs: Reverse instruction order of CLEAR_CPU_BUFFERS (Waiman Long) [RHEL-42121]
  - Revert "x86/bugs: Use fixed addressing for VERW operand" (Waiman Long) [RHEL-42121]
  - KVM/x86: Export RFDS_NO and RFDS_CLEAR to guests (Waiman Long) [RHEL-42121]
  - x86/rfds: Mitigate Register File Data Sampling (RFDS) (Waiman Long) [RHEL-42121]
  - Documentation/hw-vuln: Add documentation for RFDS (Waiman Long) [RHEL-42121]
  - x86/mmio: Disable KVM mitigation when X86_FEATURE_CLEAR_CPU_BUF is set (Waiman Long) [RHEL-42121]
  - x86/bugs: Use fixed addressing for VERW operand (Waiman Long) [RHEL-42121]
  - KVM/VMX: Use BT+JNC, i.e. EFLAGS.CF to select VMRESUME vs. VMLAUNCH (Waiman Long) [RHEL-42121]
  - x86/bugs: Use ALTERNATIVE() instead of mds_user_clear static key (Waiman Long) [RHEL-42121]
  - x86/entry_32: Add VERW just before userspace transition (Waiman Long) [RHEL-42121]
  - x86/entry_64: Add VERW just before userspace transition (Waiman Long) [RHEL-42121]
  - x86/bugs: Add asm helpers for executing VERW (Waiman Long) [RHEL-42121]
  - x86/cpu: Fix Gracemont uarch (Waiman Long) [RHEL-42121]
  - Documentation/hw-vuln: Unify filename specification in index (Waiman Long) [RHEL-42121]
  - KVM: VMX: Access @flags as a 32-bit value in __vmx_vcpu_run() (Waiman Long) [RHEL-42121]
  - x86/asm: Add _ASM_RIP() macro for x86-64 (%rip) suffix (Waiman Long) [RHEL-42121]
  - x86/asm: Have the __ASM_FORM macros handle commas in arguments (Waiman Long) [RHEL-42121]
  - x86/asm: Allow to pass macros to __ASM_FORM() (Waiman Long) [RHEL-42121]
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal (Jose Ignacio Tornos Martinez) [RHEL-39801] {CVE-2024-36921}
  - ipv6: Fix potential uninit-value access in __ip6_make_skb() (Antoine Tenart) [RHEL-39784]
  - ipv4: Fix uninit-value access in __ip_make_skb() (Antoine Tenart) [RHEL-39784] {CVE-2024-36927}
  - perf mmap: Lazily initialize zstd streams to save memory when not using it (Michael Petlan) [RHEL-34876]
  - perf tools: Fix spelling mistake "commpressor" -> "compressor" (Michael Petlan) [RHEL-34876]
  - perf record: Introduce data transferred and compressed stats (Michael Petlan) [RHEL-34876]
  - perf record: Introduce compressor at mmap buffer object (Michael Petlan) [RHEL-34876]
  - perf record: Introduce bytes written stats (Michael Petlan) [RHEL-34876]
  - perf record: Introduce data file at mmap buffer object (Michael Petlan) [RHEL-34876]
  - perf record: Start threads in the beginning of trace streaming (Alexey Bayduraev) [RHEL-34876]
  - perf record: Stop threads in the end of trace streaming (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread local variable (Michael Petlan) [RHEL-34876]
  - perf record: Introduce function to propagate control commands (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread specific data array (Michael Petlan) [RHEL-34876]
  - tools lib: Introduce fdarray duplicate function (Michael Petlan) [RHEL-34876]
  - perf record: Introduce thread affinity and mmap masks (Michael Petlan) [RHEL-34876]
  - gfs2: Be more careful with the quota sync generation (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Get rid of some unnecessary quota locking (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Add some missing quota locking (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fold qd_fish into gfs2_quota_sync (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: quota need_sync cleanup (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fix and clean up function do_qc (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Revert "Add quota_change type" (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Revert "ignore negated quota changes" (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: qd_check_sync cleanups (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Check quota consistency on mount (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Minor gfs2_quota_init error path cleanup (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: fix kernel BUG in gfs2_quota_cleanup (Edward Adam Davis) [RHEL-40901]
  - gfs2: Clean up quota.c:print_message (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Clean up gfs2_alloc_parms initializers (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Two quota=account mode fixes (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Remove useless assignment (Bob Peterson) [RHEL-40901]
  - gfs2: simplify slot_get (Bob Peterson) [RHEL-40901]
  - gfs2: Simplify qd2offset (Bob Peterson) [RHEL-40901]
  - gfs2: Remove quota allocation info from quota file (Bob Peterson) [RHEL-40901]
  - gfs2: use constant for array size (Bob Peterson) [RHEL-40901]
  - gfs2: Set qd_sync_gen in do_sync (Bob Peterson) [RHEL-40901]
  - gfs2: Remove useless err set (Bob Peterson) [RHEL-40901]
  - gfs2: Small gfs2_quota_lock cleanup (Bob Peterson) [RHEL-40901]
  - gfs2: move qdsb_put and reduce redundancy (Bob Peterson) [RHEL-40901]
  - gfs2: Don't try to sync non-changes (Bob Peterson) [RHEL-40901]
  - gfs2: Simplify function need_sync (Bob Peterson) [RHEL-40901]
  - gfs2: remove unneeded pg_oflow variable (Bob Peterson) [RHEL-40901]
  - gfs2: remove unneeded variable done (Bob Peterson) [RHEL-40901]
  - gfs2: pass sdp to gfs2_write_buf_to_page (Bob Peterson) [RHEL-40901]
  - gfs2: pass sdp in to gfs2_write_disk_quota (Bob Peterson) [RHEL-40901]
  - gfs2: Pass sdp to gfs2_adjust_quota (Bob Peterson) [RHEL-40901]
  - gfs2: remove dead code for quota writes (Bob Peterson) [RHEL-40901]
  - gfs2: Use qd_sbd more consequently (Bob Peterson) [RHEL-40901]
  - gfs2: replace 'found' with dedicated list iterator variable (Jakob Koschel) [RHEL-40901]
  - gfs2: Some whitespace cleanups (Andreas Gruenbacher) [RHEL-40901]
  - gfs2: Fix gfs2_qa_get imbalance in gfs2_quota_hold (Bob Peterson) [RHEL-40901]
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - af_unix: Fix data-races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - af_unix: Fix data races around sk->sk_shutdown. (Guillaume Nault) [RHEL-43961] {CVE-2024-38596}
  - perf/core: Fix event sibling list locking (Daniel Vacek) [RHEL-31798]
  - media: bttv: fix use after free error due to btv->timeout timer (Kate Hsuan) [RHEL-38256] {CVE-2023-52847}
  - arp: Prevent overflow in arp_req_get(). (Antoine Tenart) [RHEL-31706] {CVE-2024-26733}
  - Bluetooth: btusb: Add a new PID/VID 0489/e0c8 for MT7921 (David Marlin) [RHEL-10263]
  - mm: swap: fix race between free_swap_and_cache() and swapoff() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - swap: comments get_swap_device() with usage rule (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: __swap_entry_free() always free 1 entry (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: call free_swap_slot() in __swap_entry_free() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - mm/swapfile.c: use __try_to_reclaim_swap() in free_swap_and_cache() (Waiman Long) [RHEL-34971] {CVE-2024-26960}
  - net: amd-xgbe: Fix skb data length underflow (Ken Cox) [RHEL-43788] {CVE-2022-48743}
  - ovl: fix warning in ovl_create_real() (cki-backport-bot) [RHEL-43652] {CVE-2021-47579}
  - net/sched: initialize noop_qdisc owner (Davide Caratti) [RHEL-35056]
  - net/sched: Fix mirred deadlock on device recursion (Davide Caratti) [RHEL-35056] {CVE-2024-27010}
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() (Pavel Reichl) [RHEL-45029] {CVE-2024-39276}
  - ethernet: hisilicon: hns: hns_dsaf_misc: fix a possible array overflow in hns_dsaf_ge_srst_by_port() (Ken Cox) [RHEL-38713] {CVE-2021-47548}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound (Hangbin Liu) [RHEL-44396] {CVE-2024-33621}
  - mlxsw: spectrum_acl_tcam: Fix stack corruption (Ivan Vecera) [RHEL-26462] {CVE-2024-26586}
  - inet: inet_defrag: prevent sk release while still in use (Antoine Tenart) [RHEL-33398] {CVE-2024-26921}
  - skb_expand_head() adjust skb->truesize incorrectly (Antoine Tenart) [RHEL-33398]
  - nvmet: fix ns enable/disable possible hang (Ming Lei) [RHEL-43547]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.12.1.el8_10]
changelog:
  - net: bridge: xmit: make sure we have at least eth header len bytes (cki-backport-bot) [RHEL-44291] {CVE-2024-38538}
  - drivers/amd/pm: fix a use-after-free in kv_parse_power_table (Michel Dänzer) [RHEL-26893] {CVE-2023-52469}
  - SUNRPC: Fix a suspicious RCU usage warning (Scott Mayhew) [RHEL-30503] {CVE-2023-52623}
  - ice: Fix some null pointer dereference issues in ice_ptp.c (Petr Oros) [RHEL-26901] {CVE-2023-52471}
  - xfs: fix internal error from AGFL exhaustion (Pavel Reichl) [RHEL-45581]
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() (Phil Auld) [RHEL-38117] {CVE-2023-52707}
  - wait: add wake_up_pollfree() (Phil Auld) [RHEL-38117]
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() (Hangbin Liu) [RHEL-33269] {CVE-2024-26852}
  - net: bridge: switchdev: Skip MDB replays of deferred events on offload (Ivan Vecera) [RHEL-33117] {CVE-2024-26837}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() (Pavel Reichl) [RHEL-31700] {CVE-2024-26772}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() (Pavel Reichl) [RHEL-31688] {CVE-2024-26773}
  - ext4: fix double-free of blocks due to wrong extents moved_len (Pavel Reichl) [RHEL-31612] {CVE-2024-26704}
  - vxlan: Pull inner IP header in vxlan_xmit_one(). (Guillaume Nault) [RHEL-31389]
  - geneve: Fix incorrect inner network header offset when innerprotoinherit is set (Guillaume Nault) [RHEL-31389]
  - vxlan: Pull inner IP header in vxlan_rcv(). (Guillaume Nault) [RHEL-31389]
  - geneve: fix header validation in geneve[6]_xmit_skb (Guillaume Nault) [RHEL-31389]
  - geneve: make sure to pull inner header in geneve_rx() (Guillaume Nault) [RHEL-31389]
  - net: geneve: modify IP header check in geneve6_xmit_skb and geneve_xmit_skb (Guillaume Nault) [RHEL-31389]
  - net: geneve: check skb is large enough for IPv4/IPv6 header (Guillaume Nault) [RHEL-31389]
  - net/smc: fix neighbour and rtable leak in smc_ib_find_route() (Tobias Huschle) [RHEL-39744] {CVE-2024-36945}
  - igb: Fix string truncation warnings in igb_set_fw_version (Corinna Vinschen) [RHEL-38452] {CVE-2024-36010}
  - bonding: stop the device in bond_setup_by_slave() (Hangbin Liu) [RHEL-38327] {CVE-2023-52784}
  - i40e: fix vf may be used uninitialized in this function warning (Kamal Heib) [RHEL-39702] {CVE-2024-36020}
  - powerpc/64: Fix the definition of the fixmap area (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018}
  - powerpc/mm/hash64: Add a variable to track the end of IO mapping (Mamatha Inamdar) [RHEL-27191] {CVE-2021-47018}
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). (Xin Long) [RHEL-39770] {CVE-2024-36933}
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() (Xin Long) [RHEL-39770]
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs (Xin Long) [RHEL-39779] {CVE-2024-36929}
  - tcp: properly terminate timers for kernel sockets (Guillaume Nault) [RHEL-37171] {CVE-2024-35910}
  - net: relax socket state check at accept time. (Florian Westphal) [RHEL-39831]
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets (Florian Westphal) [RHEL-39831] {CVE-2024-36905}
  - tcp: remove redundant check on tskb (Florian Westphal) [RHEL-39831]
  - drm/ast: Fix soft lockup (cki-backport-bot) [RHEL-37438] {CVE-2024-35952}
  - null_blk: Fix return value of nullb_device_power_store() (Ming Lei) [RHEL-39341]
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' (Ming Lei) [RHEL-39341]
  - null_blk: fix return value from null_add_dev() (Ming Lei) [RHEL-39341]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.13.1.el8_10]
changelog:
  - redhat: remove handling of deleted rhdocs/ directory from genspec.sh (Denys Vlasenko)
  - x86/bugs: Fix BHI retpoline check (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Replace CONFIG_SPECTRE_BHI_{ON,OFF} with CONFIG_MITIGATION_SPECTRE_BHI (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Remove CONFIG_BHI_MITIGATION_AUTO and spectre_bhi=auto (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Clarify that syscall hardening isn't a BHI mitigation (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix BHI handling of RRSBA (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Rename various 'ia32_cap' variables to 'x86_arch_cap_msr' (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Cache the value of MSR_IA32_ARCH_CAPABILITIES (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix BHI documentation (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Fix return type of spectre_bhi_state() (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Make CONFIG_SPECTRE_BHI_ON the default (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Mitigate KVM by default (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Add BHI mitigation knob (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Enumerate Branch History Injection (BHI) bug (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Define SPEC_CTRL_BHI_DIS_S (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bhi: Add support for clearing branch history at syscall entry (Waiman Long) [RHEL-28202] {CVE-2024-2201}
  - x86/bugs: Change commas to semicolons in 'spectre_v2' sysfs file (Waiman Long) [RHEL-28202]
  - perf/x86/amd/lbr: Use freeze based on availability (Waiman Long) [RHEL-28202]
  - Documentation/kernel-parameters: Add spec_rstack_overflow to mitigations=off (Waiman Long) [RHEL-28202]
  - KVM: x86: Advertise CPUID.(EAX=7,ECX=2):EDX[5:0] to userspace (Waiman Long) [RHEL-28202]
  - x86/bugs: Reset speculation control settings on init (Waiman Long) [RHEL-28202]
  - KVM: x86: Update KVM-only leaf handling to allow for 100% KVM-only leafs (Waiman Long) [RHEL-28202]
  - KVM: x86: Hide IA32_PLATFORM_DCA_CAP[31:0] from the guest (Waiman Long) [RHEL-28202]
  - mptcp: ensure snd_nxt is properly initialized on connect (Davide Caratti) [RHEL-39865] {CVE-2024-36889}
  - powerpc/pseries: Enforce hcall result buffer validity and size (Mamatha Inamdar) [RHEL-48291] {CVE-2024-40974}
  - wifi: mac80211: fix potential key use-after-free (Jose Ignacio Tornos Martinez) [RHEL-28007] {CVE-2023-52530}
  - cppc_cpufreq: Fix possible null pointer dereference (Mark Langsdorf) [RHEL-44137] {CVE-2024-38573}
  - net/sched: act_mirred: use the backlog for mirred ingress (Davide Caratti) [RHEL-31718] {CVE-2024-26740}
  - vfio/pci: Lock external INTx masking ops (Alex Williamson) [RHEL-31922] {CVE-2024-26810}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() (Davide Caratti) [RHEL-43464] {CVE-2024-36978}
  - tcp: fix tcp_init_transfer() to not reset icsk_ca_initialized (Guillaume Nault) [RHEL-37850] {CVE-2021-47304}
  - pstore/ram: Fix crash when setting number of cpus to an odd number (Lenny Szubowicz) [RHEL-29471] {CVE-2023-52619}
  - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node (Jocelyn Falempe) [RHEL-37101] {CVE-2023-52662}
  - drm/vmwgfx: Fix the lifetime of the bo cursor memory (Jocelyn Falempe) [RHEL-36962] {CVE-2024-35810}
  - drm/vmwgfx: Create debugfs ttm_resource_manager entry only if needed (Jocelyn Falempe) [RHEL-34987] {CVE-2024-26940}
  - drm/vmwgfx: Unmap the surface before resetting it on a plane state (Jocelyn Falempe) [RHEL-35217] {CVE-2023-52648}
  - drm/vmwgfx: Fix invalid reads in fence signaled events (Jocelyn Falempe) [RHEL-40010] {CVE-2024-36960}
  - block: Fix wrong offset in bio_truncate() (Ming Lei) [RHEL-43782] {CVE-2022-48747}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() (CKI Backport Bot) [RHEL-46913] {CVE-2024-39487}
  - net: fix __dst_negative_advice() race (Xin Long) [RHEL-41183] {CVE-2024-36971}
  - igc: avoid returning frame twice in XDP_REDIRECT (Corinna Vinschen) [RHEL-33264] {CVE-2024-26853}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del (Steve Best) [RHEL-34967] {CVE-2024-26961}
  - cpufreq: exit() callback is optional (Mark Langsdorf) [RHEL-43840] {CVE-2024-38615}
  - cifs: prevent infinite recursion in CIFSGetDFSRefer() (Paulo Alcantara) [RHEL-34672]
  - cifs: lock chan_lock outside match_session (Paulo Alcantara) [RHEL-34672]
  - smb3: workaround negprot bug in some Samba servers (Paulo Alcantara) [RHEL-34672]
  - smb3: use netname when available on secondary channels (Paulo Alcantara) [RHEL-34672]
  - smb3: fix empty netname context on secondary channels (Paulo Alcantara) [RHEL-34672]
  - cifs: populate empty hostnames for extra channels (Paulo Alcantara) [RHEL-34672]
  - cifs: always iterate smb sessions using primary channel (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix connections leak when tlink setup failed (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix memory leak when build ntlmssp negotiate blob failed (Paulo Alcantara) [RHEL-34672]
  - cifs: always initialize struct msghdr smb_msg completely (Paulo Alcantara) [RHEL-34672]
  - cifs: don't send down the destination address to sendmsg for a SOCK_STREAM (Paulo Alcantara) [RHEL-34672]
  - cifs: revalidate mapping when doing direct writes (Paulo Alcantara) [RHEL-34672]
  - cifs: skip extra NULL byte in filenames (Paulo Alcantara) [RHEL-34672]
  - cifs: list_for_each() -> list_for_each_entry() (Paulo Alcantara) [RHEL-34672]
  - smb2: small refactor in smb2_check_message() (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix crash on unload of cifs_arc4.ko (Paulo Alcantara) [RHEL-34672]
  - cifs: remove check of list iterator against head past the loop body (Paulo Alcantara) [RHEL-34672]
  - cifs: fix reconnect on smb3 mount types (Paulo Alcantara) [RHEL-34672]
  - cifs: fix uninitialized pointer in error case in dfs_cache_get_tgt_share (Paulo Alcantara) [RHEL-34672]
  - cifs: skip trailing separators of prefix paths (Paulo Alcantara) [RHEL-34672]
  - cifs: fix ntlmssp on old servers (Paulo Alcantara) [RHEL-34672]
  - cifs: fix NULL ptr dereference in refresh_mounts() (Paulo Alcantara) [RHEL-34672]
  - cifs: do not skip link targets when an I/O fails (Paulo Alcantara) [RHEL-34672]
  - cifs: fix confusing unneeded warning message on smb2.1 and earlier (Paulo Alcantara) [RHEL-34672]
  - smb3: fix snapshot mount option (Paulo Alcantara) [RHEL-34672]
  - cifs: fix workstation_name for multiuser mounts (Paulo Alcantara) [RHEL-34672]
  - cifs: alloc_path_with_tree_prefix: do not append sep. if the path is empty (Paulo Alcantara) [RHEL-34672]
  - cifs: free ntlmsspblob allocated in negotiate (Paulo Alcantara) [RHEL-34672]
  - cifs: avoid use of dstaddr as key for fscache client cookie (Paulo Alcantara) [RHEL-34672]
  - cifs: add server conn_id to fscache client cookie (Paulo Alcantara) [RHEL-34672]
  - cifs: fix missed refcounting of ipc tcon (Paulo Alcantara) [RHEL-34672]
  - smb2: clarify rc initialization in smb2_reconnect (Paulo Alcantara) [RHEL-34672]
  - cifs: populate server_hostname for extra channels (Paulo Alcantara) [RHEL-34672]
  - cifs: nosharesock should be set on new server (Paulo Alcantara) [RHEL-34672]
  - cifs: introduce cifs_ses_mark_for_reconnect() helper (Paulo Alcantara) [RHEL-34672]
  - cifs: protect srv_count with cifs_tcp_ses_lock (Paulo Alcantara) [RHEL-34672]
  - cifs: move debug print out of spinlock (Paulo Alcantara) [RHEL-34672]
  - cifs: do not duplicate fscache cookie for secondary channels (Paulo Alcantara) [RHEL-34672]
  - cifs: connect individual channel servers to primary channel server (Paulo Alcantara) [RHEL-34672]
  - cifs: protect session channel fields with chan_lock (Paulo Alcantara) [RHEL-34672]
  - cifs: do not negotiate session if session already exists (Paulo Alcantara) [RHEL-34672]
  - smb3: do not setup the fscache_super_cookie until fsinfo initialized (Paulo Alcantara) [RHEL-34672]
  - cifs: fix potential use-after-free bugs (Paulo Alcantara) [RHEL-34672]
  - cifs: release lock earlier in dequeue_mid error case (Paulo Alcantara) [RHEL-34672]
  - smb3: remove trivial dfs compile warning (Paulo Alcantara) [RHEL-34672]
  - cifs: support nested dfs links over reconnect (Paulo Alcantara) [RHEL-34672]
  - cifs: for compound requests, use open handle if possible (Paulo Alcantara) [RHEL-34672]
  - cifs: split out dfs code from cifs_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant (Paulo Alcantara) [RHEL-34672]
  - cifs: introduce new helper for cifs_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix print of hdr_flags in dfscache_proc_show() (Paulo Alcantara) [RHEL-34672]
  - cifs: send workstation name during ntlmssp session setup (Paulo Alcantara) [RHEL-34672]
  - cifs: nosharesock should not share socket with future sessions (Paulo Alcantara) [RHEL-34672]
  - smb3: add dynamic trace points for socket connection (Paulo Alcantara) [RHEL-34672]
  - cifs: Move SMB2_Create definitions to the shared area (Paulo Alcantara) [RHEL-34672]
  - cifs: Move more definitions into the shared area (Paulo Alcantara) [RHEL-34672]
  - cifs: move NEGOTIATE_PROTOCOL definitions out into the common area (Paulo Alcantara) [RHEL-34672]
  - cifs: Create a new shared file holding smb2 pdu definitions (Paulo Alcantara) [RHEL-34672]
  - cifs: fix incorrect check for null pointer in header_assemble (Paulo Alcantara) [RHEL-34672]
  - smb3: correct server pointer dereferencing check to be more consistent (Paulo Alcantara) [RHEL-34672]
  - cifs: Deal with some warnings from W=1 (Paulo Alcantara) [RHEL-34672]
  - cifs: fix a sign extension bug (Paulo Alcantara) [RHEL-34672]
  - cifs: fix incorrect kernel doc comments (Paulo Alcantara) [RHEL-34672]
  - cifs: remove pathname for file from SPDX header (Paulo Alcantara) [RHEL-34672]
  - cifs: move SMB FSCTL definitions to common code (Paulo Alcantara) [RHEL-34672]
  - cifs: rename cifs_common to smbfs_common (Paulo Alcantara) [RHEL-34672]
  - cifs: update FSCTL definitions (Paulo Alcantara) [RHEL-34672]
  - cifs: cifs_md4 convert to SPDX identifier (Paulo Alcantara) [RHEL-34672]
  - cifs: create a MD4 module and switch cifs.ko to use it (Paulo Alcantara) [RHEL-34672]
  - cifs: fork arc4 and create a separate module for it for cifs and other users (Paulo Alcantara) [RHEL-34672]
  - smb3: fix posix extensions mount option (Paulo Alcantara) [RHEL-34672]
  - cifs: fix wrong release in sess_alloc_buffer() failed path (Paulo Alcantara) [RHEL-34672]
  - CIFS: Fix a potencially linear read overflow (Paulo Alcantara) [RHEL-34672]
  - cifs: use the correct max-length for dentry_path_raw() (Paulo Alcantara) [RHEL-34672]
  - cifs: create sd context must be a multiple of 8 (Paulo Alcantara) [RHEL-34672]
  - cifs: do not share tcp sessions of dfs connections (Paulo Alcantara) [RHEL-34672]
  - cifs: added WARN_ON for all the count decrements (Paulo Alcantara) [RHEL-34672]
  - cifs: fix missing null session check in mount (Paulo Alcantara) [RHEL-34672]
  - cifs: handle reconnect of tcon when there is no cached dfs referral (Paulo Alcantara) [RHEL-34672]
  - cifs: fix the out of range assignment to bit fields in parse_server_interfaces (Paulo Alcantara) [RHEL-34672]
  - smb3: fix typo in header file (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: Add support for negotiating signing algorithm (Paulo Alcantara) [RHEL-34672]
  - cifs: prevent NULL deref in cifs_compose_mount_options() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix NULL dereference in smb2_check_message() (Paulo Alcantara) [RHEL-34672]
  - smbdirect: missing rc checks while waiting for rdma events (Paulo Alcantara) [RHEL-34672]
  - cifs: Avoid field over-reading memcpy() (Paulo Alcantara) [RHEL-34672]
  - smb311: remove dead code for non compounded posix query info (Paulo Alcantara) [RHEL-34672]
  - cifs: fix SMB1 error path in cifs_get_file_info_unix (Paulo Alcantara) [RHEL-34672]
  - smb3: fix uninitialized value for port in witness protocol move (Paulo Alcantara) [RHEL-34672]
  - cifs: fix unneeded null check (Paulo Alcantara) [RHEL-34672]
  - cifs: use SPDX-Licence-Identifier (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant in cifs_debug.c (Paulo Alcantara) [RHEL-34672]
  - cifs: convert list_for_each to entry variant in smb2misc.c (Paulo Alcantara) [RHEL-34672]
  - cifs: missed ref-counting smb session in find (Paulo Alcantara) [RHEL-34672]
  - cifs: do not share tcp servers with dfs mounts (Paulo Alcantara) [RHEL-34672]
  - cifs: set a minimum of 2 minutes for refreshing dfs cache (Paulo Alcantara) [RHEL-34672]
  - cifs: Remove unused inline function is_sysvol_or_netlogon() (Paulo Alcantara) [RHEL-34672]
  - cifs: remove duplicated prototype (Paulo Alcantara) [RHEL-34672]
  - cifs: fix ipv6 formating in cifs_ses_add_channel (Paulo Alcantara) [RHEL-34672]
  - cifs: fix string declarations and assignments in tracepoints (Paulo Alcantara) [RHEL-34672]
  - cifs: fix memory leak in smb2_copychunk_range (Paulo Alcantara) [RHEL-34672]
  - SMB3: incorrect file id in requests compounded with open (Paulo Alcantara) [RHEL-34672]
  - smb3: if max_channels set to more than one channel request multichannel (Paulo Alcantara) [RHEL-34672]
  - smb3: do not attempt multichannel to server which does not support it (Paulo Alcantara) [RHEL-34672]
  - smb3: when mounting with multichannel include it in requested capabilities (Paulo Alcantara) [RHEL-34672]
  - cifs: simplify SWN code with dummy funcs instead of ifdefs (Paulo Alcantara) [RHEL-34672]
  - cifs: log mount errors using cifs_errorf() (Paulo Alcantara) [RHEL-34672]
  - cifs: switch build_path_from_dentry() to using dentry_path_raw() (Paulo Alcantara) [RHEL-34672]
  - cifs: fix out-of-bound memory access when calling smb3_notify() at mount point (Paulo Alcantara) [RHEL-34672]
  - cifs: allocate buffer in the caller of build_path_from_dentry() (Paulo Alcantara) [RHEL-34672]
  - cifs: make build_path_from_dentry() return const char * (Paulo Alcantara) [RHEL-34672]
  - cifs: remove old dead code (Paulo Alcantara) [RHEL-34672]
  - fs: cifs: Remove repeated struct declaration (Paulo Alcantara) [RHEL-34672]
  - cifs: have cifs_fattr_to_inode() refuse to change type on live inode (Paulo Alcantara) [RHEL-34672]
  - cifs: have ->mkdir() handle race with another client sanely (Paulo Alcantara) [RHEL-34672]
  - do_cifs_create(): don't set ->i_mode of something we had not created (Paulo Alcantara) [RHEL-34672]
  - cifs: Silently ignore unknown oplock break handle (Paulo Alcantara) [RHEL-34672]
  - cifs: change noisy error message to FYI (Paulo Alcantara) [RHEL-34672]
  - cifs: print MIDs in decimal notation (Paulo Alcantara) [RHEL-34672]
  - cifs: minor simplification to smb2_is_network_name_deleted (Paulo Alcantara) [RHEL-34672]
  - TCON Reconnect during STATUS_NETWORK_NAME_DELETED (Paulo Alcantara) [RHEL-34672]
  - cifs: clarify hostname vs ip address in /proc/fs/cifs/DebugData (Paulo Alcantara) [RHEL-34672]
  - cifs: change confusing field serverName (to ip_addr) (Paulo Alcantara) [RHEL-34672]
  - cifs: Reformat DebugData and index connections by conn_id. (Paulo Alcantara) [RHEL-34672]
  - cifs: Identify a connection by a conn_id. (Paulo Alcantara) [RHEL-34672]
  - smb3: negotiate current dialect (SMB3.1.1) when version 3 or greater requested (Paulo Alcantara) [RHEL-34672]
  - smb3: Fix out-of-bounds bug in SMB2_negotiate() (Paulo Alcantara) [RHEL-34672]
  - fs/cifs: Simplify bool comparison. (Paulo Alcantara) [RHEL-34672]
  - fs/cifs: Assign boolean values to a bool variable (Paulo Alcantara) [RHEL-34672]
  - cifs: Avoid error pointer dereference (Paulo Alcantara) [RHEL-34672]
  - cifs: Re-indent cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Unlock on errors in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Delete a stray unlock in cifs_swn_reconnect() (Paulo Alcantara) [RHEL-34672]
  - cifs: Tracepoints and logs for tracing credit changes. (Paulo Alcantara) [RHEL-34672]
  - cifs: Fix some error pointers handling detected by static checker (Paulo Alcantara) [RHEL-34672]
  - smb3: remind users that witness protocol is experimental (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: do not log warning message if server doesn't populate salt (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: update comments clarifying SPNEGO info in negprot response (Paulo Alcantara) [RHEL-34672]
  - SMB3.1.1: remove confusing mount warning when no SPNEGO info on negprot rsp (Paulo Alcantara) [RHEL-34672]
  - SMB3: avoid confusing warning message on mount to Azure (Paulo Alcantara) [RHEL-34672]
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING (Nigel Croxon) [RHEL-46662] {CVE-2024-39476}
  - net: fix information leakage in /proc/net/ptype (Hangbin Liu) [RHEL-44000] {CVE-2022-48757}
  - usb: typec: ucsi: Limit read size on v1.2 (Desnes Nunes) [RHEL-37286] {CVE-2024-35924}
  - minmax: relax check to allow comparison between unsigned arguments and signed constants (Desnes Nunes) [RHEL-37286]
  - minmax: allow comparisons of 'int' against 'unsigned char/short' (Desnes Nunes) [RHEL-37286]
  - minmax: allow min()/max()/clamp() if the arguments have the same signedness. (Desnes Nunes) [RHEL-37286]
  - minmax: add umin(a, b) and umax(a, b) (Desnes Nunes) [RHEL-37286]
  - minmax: fix header inclusions (Desnes Nunes) [RHEL-37286]
  - minmax: clamp more efficiently by avoiding extra comparison (Desnes Nunes) [RHEL-37286]
  - minmax: sanity check constant bounds when clamping (Desnes Nunes) [RHEL-37286]
  - tracing: Define the is_signed_type() macro once (Desnes Nunes) [RHEL-37286]
  - linux/bits.h: fix compilation error with GENMASK (Desnes Nunes) [RHEL-37286]
  - x86/apic: Mask IOAPIC entries when disabling the local APIC (Lenny Szubowicz) [RHEL-18077]
  - userfaultfd: fix a race between writeprotect and exit_mmap() (Rafael Aquini) [RHEL-38410] {CVE-2021-47461}
  - mm: khugepaged: skip huge page collapse for special files (Waiman Long) [RHEL-38446] {CVE-2021-47491}
  - cachefiles: fix memory leak in cachefiles_add_cache() (Andrey Albershteyn) [RHEL-33109] {CVE-2024-26840}
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 (Michel Dänzer) [RHEL-31429] {CVE-2024-26660}
  - net/mlx5: Discard command completions in internal error (Kamal Heib) [RHEL-44231] {CVE-2024-38555}
  - drm: Don't unref the same fb many times by mistake due to deadlock handling (CKI Backport Bot) [RHEL-29011] {CVE-2023-52486}
  - md: fix resync softlockup when bitmap size is less than array size (Nigel Croxon) [RHEL-43942] {CVE-2024-38598}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation (Davide Caratti) [RHEL-39712] {CVE-2024-36017}
  - netfilter: nf_tables: discard table flag update with pending basechain deletion (Phil Sutter) [RHEL-37205] {CVE-2024-35897}
  - netfilter: nf_tables: reject table flag and netdev basechain updates (Phil Sutter) [RHEL-37205]
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() (Ewan D. Milne) [RHEL-40172] {CVE-2024-36924}
  - scsi: lpfc: Move NPIV's transport unregistration to after resource clean up (Ewan D. Milne) [RHEL-40172] {CVE-2024-36952}
  - netfilter: nf_tables: fix memleak in map from abort path (Phil Sutter) [RHEL-35052] {CVE-2024-27011}
  - netfilter: nf_tables: reject new basechain after table flag update (Phil Sutter) [RHEL-37193] {CVE-2024-35900}
  - netfilter: nf_tables: flush pending destroy work before exit_net release (Phil Sutter) [RHEL-37197] {CVE-2024-35899}
  - netfilter: complete validation of user input (Phil Sutter) [RHEL-37210]
  - netfilter: validate user input for expected length (Phil Sutter) [RHEL-37210] {CVE-2024-35896}
  - netfilter: tproxy: bail out if IP has been disabled on the device (Phil Sutter) [RHEL-44363] {CVE-2024-36270}
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() (Phil Sutter) [RHEL-44532] {CVE-2024-36286}
  - netfilter: nf_tables: do not compare internal table flags on updates (Phil Sutter) [RHEL-35114] {CVE-2024-27065}
  - netfilter: nf_tables: Fix potential data-race in __nft_obj_type_get() (Phil Sutter) [RHEL-35028] {CVE-2024-27019}
  - netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get() (Phil Sutter) [RHEL-35024] {CVE-2024-27020}
  - netfilter: nf_tables: __nft_expr_type_get() selects specific family type (Phil Sutter) [RHEL-35024]
  - netfilter: conntrack: serialize hash resizes and cleanups (Phil Sutter) [RHEL-37703] {CVE-2021-47408}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path (Phil Sutter) [RHEL-34217] {CVE-2024-26925}
  - netfilter: nf_tables: release batch on table validation from abort path (Phil Sutter) [RHEL-34217]
  - ipvlan: add ipvlan_route_v6_outbound() helper (Davide Caratti) [RHEL-38319] {CVE-2023-52796}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.14.1.el8_10]
changelog:
  - s390/qeth: Fix kernel panic after setting hsuid (Mete Durlu) [RHEL-49754]
  - perf/core: Protect event sibling list locking against interrupt inversion (Daniel Vacek) [RHEL-31798]
  - vt: fix unicode buffer corruption when deleting characters (Steve Best) [RHEL-36936] {CVE-2024-35823}
  - cifs: translate network errors on send to -ECONNABORTED (Paulo Alcantara) [RHEL-36754]
  - xfs: don't block in busy flushing when freeing extents (Brian Foster) [RHEL-7984]
  - xfs: allow extent free intents to be retried (Brian Foster) [RHEL-7984]
  - xfs: pass alloc flags through to xfs_extent_busy_flush() (Brian Foster) [RHEL-7984]
  - xfs: use deferred frees for btree block freeing (Brian Foster) [RHEL-7984]
  - xfs: fix bounds check in xfs_defer_agfl_block() (Brian Foster) [RHEL-7984]
  - xfs: validate block number being freed before adding to xefi (Brian Foster) [RHEL-7984]
  - xfs: rename xfs_bmap_add_free to xfs_free_extent_later (Brian Foster) [RHEL-7984]
  - usb: typec: altmodes/displayport: create sysfs nodes as driver's default device attribute group (Desnes Nunes) [RHEL-36803] {CVE-2024-35790}
  - stm class: Fix a double free in stm_register_device() (Steve Best) [RHEL-44514] {CVE-2024-38627}
  - s390/qeth: Fix potential loss of L3-IP@ in case of network issues (Mete Durlu) [RHEL-49755]
  - tls: fix missing memory barrier in tls_init (cki-backport-bot) [RHEL-44471] {CVE-2024-36489}
  - xfs: fix log recovery buffer allocation for the legacy h_size fixup (Bill O'Donnell) [RHEL-46473] {CVE-2024-39472}
  - fs/proc: do_task_stat: use sig->stats_lock to gather the threads/children stats (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - fs/proc: do_task_stat: move thread_group_cputime_adjusted() outside of lock_task_sighand() (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - fs/proc: do_task_stat: use __for_each_thread() (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - exit: Use the correct exit_code in /proc/<pid>/stat (Brian Foster) [RHEL-31562] {CVE-2024-26686}
  - scsi: ibmvfc: Remove BUG_ON in the case of an empty event pool (Ewan D. Milne) [RHEL-38283] {CVE-2023-52811}
  - scsi: qla2xxx: Fix double free of fcport (Ewan D. Milne) [RHEL-39549] {CVE-2024-26929}
  - scsi: qla2xxx: Fix double free of the ha->vp_map pointer (Ewan D. Milne) [RHEL-39549] {CVE-2024-26930}
  - scsi: qla2xxx: Fix command flush on cable pull (Ewan D. Milne) [RHEL-39549] {CVE-2024-26931}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.15.1.el8_10]
changelog:
  - Revert "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-44613]
  - ionic: fix use after netif_napi_del() (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race (CKI Backport Bot) [RHEL-47624] {CVE-2024-39502}
  - net/sunrpc: fix reference count leaks in rpc_sysfs_xprt_state_change (CKI Backport Bot) [RHEL-49321] {CVE-2021-47624}
  - xhci: Handle TD clearing for multiple streams case (CKI Backport Bot) [RHEL-47882] {CVE-2024-40927}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit (cki-backport-bot) [RHEL-36362] {CVE-2024-27395}
  - net: bridge: mst: fix suspicious rcu usage in br_mst_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979}
  - net: bridge: mst: pass vlan group directly to br_mst_vlan_set_state (Ivan Vecera) [RHEL-43721] {CVE-2024-36979}
  - net: bridge: mst: fix vlan use-after-free (cki-backport-bot) [RHEL-43721] {CVE-2024-36979}
  - irqchip/gic-v3-its: Prevent double free on error (Charles Mirabile) [RHEL-37022] {CVE-2024-35847}
  - irqchip/gic-v3-its: Fix potential VPE leak on error (Charles Mirabile) [RHEL-37744] {CVE-2021-47373}
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() (Charles Mirabile) [RHEL-34735] {CVE-2022-48632}
  - iommu/dma: fix zeroing of bounce buffer padding used by untrusted devices (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: remove alloc_size argument to swiotlb_tbl_map_single() (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: fix swiotlb_bounce() to do partial sync's correctly (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: extend buffer pre-padding to alloc_align_mask if necessary (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Reinstate page-alignment for mappings >= PAGE_SIZE (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Fix alignment checks when both allocation and DMA masks are present (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - swiotlb: Fix double-allocation of slots due to broken alignment handling (Eder Zulian) [RHEL-36954] {CVE-2024-35814}
  - genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline (cki-backport-bot) [RHEL-44441] {CVE-2024-31076}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.16.1.el8_10]
changelog:
  - x86/bhi: Fix incorrect CLEAR_BRANCH_HISTORY position in entry_INT80_compat (Waiman Long) [RHEL-50648]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.17.1.el8_10]
changelog:
  - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984}
  - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874]
  - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874]
  - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338}
  - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005}
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609}
  - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960}
  - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717}
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997}
  - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877}
  - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470}
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760}
  - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517]
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884}
  - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012}
  - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695]
  - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695]
  - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954}
  - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499}
  - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527}
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065}
  - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064}
  - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096}
  - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931}
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506}
  - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091}
  - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090}
  - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384}
  - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074]
  - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074]
  - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385}
  - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880}
  - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386}
  - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497}
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287}
  - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754}
  - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455}
  - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090}
  - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084}
  - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923}
  - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352}
  - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522}
  - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665}
  - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840}
  - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958}
  - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645}
  - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072]
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056}
  - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843]
  - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995}
  - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883}
  - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310]
  - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310]
  - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310]
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989}
  - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013}
  - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014}
  - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330]
  - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.18.1.el8_10]
changelog:
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920}
  - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013}
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581}
  - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042}
  - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040}
  - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154}
  - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508]
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508]
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124}
  - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478}
  - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988}
  - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977}
  - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433]
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941}
  - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988]
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929}
  - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226}
  - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911}
  - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097}
  - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939}
  - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041}
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356}
  - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007}
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627]
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627]
  - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627]
  - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627]
  - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.19.1.el8_10]
changelog:
  - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939}
  - RHEL-48620 (Kenneth Yin) [RHEL-48620]
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855}
  - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936]
  - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936]
  - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646]
  - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919}
  - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638}
  - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152}
  - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901}
  - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830}
  - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559}
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902}
  - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094}
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400]
  - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027]
  - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238}
  - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237}
  - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800}
  - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798}
  - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236]
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809}
  - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846}
  - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866}
  - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797]
  - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797]
  - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797]
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131}
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.20.1.el8_10]
changelog:
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600}
  - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683}
  - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023}
  - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515]
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595}
  - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894}
  - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904]
  - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904]
  - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998}
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.21.1.el8_10]
changelog:
  - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874]
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558}
  - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904}
  - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246}
  - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008}
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.22.1.el8_10]
changelog:
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.23.1.el8_10]
changelog:
  - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002]
  - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924}
  - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042}
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976}
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540}
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284}
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857}
  - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924}
  - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983}
  - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854}
  - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936}
  - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880}
  - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.24.1.el8_10]
changelog:
  - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729]
  - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889}
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000]
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935}
  - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586}
  - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018}
  - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.25.1.el8_10]
changelog:
  - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052]
  - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052]
  - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052]
  - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052]
  - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052]
  - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052]
  - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052]
  - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052]
  - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052]
  - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052]
  - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052]
  - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052]
  - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092}
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224]
  - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292}
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079}
  - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.26.1.el8_10]
changelog:
  - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062}
  - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037]
  - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156]
  - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757]
  - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757]
  - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757]
  - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492}
  - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939}
  - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075]
  - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397]
  - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251]
  - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251]
  - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251]
  - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.27.1.el8_10]
changelog:
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668}
  - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990}
  - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009}
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773}
  - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257]
  - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257]
  - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826}
  - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100]
  - loopback: fix lockdep splat (Xin Long) [RHEL-58100]
  - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100]
  - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.28.1.el8_10]
changelog:
  - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702]
  - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400]
  - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400]
  - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400]
  - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991]
  - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann)
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709]
  - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004]
  - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999]
  - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.29.1.el8_10]
changelog:
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399}
  - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858}
  - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.30.1.el8_10]
changelog:
  - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043}
  - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200]
  - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684]
  - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363]
  - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363]
  - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168]
  - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168]
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.31.1.el8_10]
changelog:
  - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256}
  - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862]
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862]
  - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988]
  - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988]
  - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988]
  - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988]
  - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988]
  - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988]
  - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695}
  - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823]
  - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823]
  - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.32.1.el8_10]
changelog:
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082}
  - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869]
  - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869]
  - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080]
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264}
  - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.33.1.el8_10]
changelog:
  - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073]
  - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796]
  - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.34.1.el8_10]
changelog:
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122}
  - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647]
  - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924]
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974]
  - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362]
  - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860]
  - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}
  - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.35.1.el8_10]
changelog:
  - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480]
  - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480]
  - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396]
  - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.36.1.el8_10]
changelog:
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649]
  - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790]
  - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790]
  - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.37.1.el8_10]
changelog:
  - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275}
  - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275]
  - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.38.1.el8_10]
changelog:
  - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891]
  - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385]
  - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385]
  - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451]
  - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451]
  - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451]
  - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451]
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387]
  - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.40.1.el8_10]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.41.1.el8_10]
changelog:
  - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886]
  - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.42.1.el8_10]
changelog:
  - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261]
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458]
  - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950]
  - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415]
  - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161]
  - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.43.1.el8_10]
changelog:
  - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999]
  - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999]
  - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894]
  - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971]
  - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229]
  - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807}
  - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756]
  - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.44.1.el8_10]
changelog:
  - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302}
  - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197}
  - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.45.1.el8_10]
changelog:
  - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269]
  - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269]
  - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269]
  - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269]
  - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269]
  - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937}
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269]
  - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922}
  - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694]
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694]
  - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810]
  - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.46.1.el8_10]
changelog:
  - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934]
  - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934]
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832]
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785}
  - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.47.1.el8_10]
changelog:
  - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136]
  - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156]
  - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-549.el8]
changelog:
  - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678]
  - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678]
  - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934]
  - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934]
  - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934]
  - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934]
  - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-550.el8]
changelog:
  - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489}
  - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-551.el8]
changelog:
  - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742}
  - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992]
  - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.el8]
changelog:
  - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248]
  - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.1.1.el8_10]
changelog:
  - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko)
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185}
  - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579]
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744}
  - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743}
  - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664}
  - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776]
  - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528}
  - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130]
  - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130]
  - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444]
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607}
  - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477}
  - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565}
  - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445}
  - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593}
  - overlay: disable EVM (Coiby Xu) [RHEL-19863]
  - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863]
  - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863]
  - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286]
  - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777}
  - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784]
  - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162}
  - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934}
  - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520}
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340}
  - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513}
  - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603}
  - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782}
  - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136]
  - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456]
  - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.2.1.el8_10]
changelog:
  - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615}
  - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779}
  - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401]
  - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401]
  - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118}
  - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872}
  - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723]
  - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870]
  - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870]
  - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973}
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901}
  - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652]
  - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652]
  - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652]
  - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652]
  - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652]
  - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652]
  - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652]
  - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652]
  - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652]
  - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652]
  - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652]
  - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652]
  - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652]
  - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652]
  - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652]
  - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652]
  - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652]
  - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652]
  - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652]
  - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652]
  - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652]
  - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652]
  - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652]
  - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652]
  - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652]
  - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652]
  - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652]
  - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652]
  - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652]
  - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652]
  - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652]
  - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652]
  - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652]
  - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652]
  - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652]
  - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652]
  - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652]
  - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.3.1.el8_10]
changelog:
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643}
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642}
  - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576]
  - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307}
  - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919}
  - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059}
  - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912]
  - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964}
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993}
  - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521]
  - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516]
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.4.1.el8_10]
changelog:
  - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117]
  - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014}
  - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676]
  - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676]
  - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}
  - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.5.1.el8_10]
changelog:
  - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238]
  - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238]
  - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439}
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013}
  - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772]
  - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772]
  - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772]
  - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772]
  - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052}
  - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897}
  - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693}
  - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594}
  - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595}
  - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.48.1.el8_10]
changelog:
  - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves)
  - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208]
  - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208]
  - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208]
  - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.49.1.el8_10]
changelog:
  - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244]
  - redhat: drop Y issues from changelog (Jan Stancek)
  - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673]
  - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673]
  - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673]
  - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673]
  - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673]
  - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499]
  - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
  - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.50.1.el8_10]
changelog:
  - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119]
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150}
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052]
  - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852]
  - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852]
  - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.51.1.el8_10]
changelog:
  - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072]
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.52.1.el8_10.gfd1b]
changelog:
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141}
  - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285]
  - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266]
  - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266]
  - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266]
  - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266]
  - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342]
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.53.1.el8_10]
changelog:
  - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906}
  - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712]
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970}
  - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717}
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819]
  - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714]
  - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793]
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.54.1.el8_10]
changelog:
  - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834]
  - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842}
  - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.56.1.el8_10]
changelog:
  - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963]
  - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.57.1.el8_10]
changelog:
  - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825]
  - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919}
  - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.58.1.el8_10]
changelog:
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535]
  - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116}
  - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182]
  - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182]
  - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182]
  - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182]
  - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182]
  - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065}
  - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890}
  - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182]
  - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182]
  - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057}
  - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182]
  - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182]
  - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182]
  - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182]
  - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182]
  - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849]
  - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064}
  - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274}
  - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182]
  - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932}
  - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182]
  - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964}
  - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182]
  - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182]
  - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182]
  - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182]
  - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182]
  - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182]
  - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182]
  - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182]
  - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182]
  - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182]
  - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783]
  - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783]
  - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.59.1.el8_10]
changelog:
  - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291]
  - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291]
  - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291]
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132]
  - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
  - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136}
  - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709]
  - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932]
  - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.60.1.el8_10]
changelog:
  - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037]
  - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037]
  - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.61.1.el8_10]
changelog:
  - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409]
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150}
  - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.62.1.el8_10]
changelog:
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557]
  - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410]
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410]
  - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410]
  - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410]
  - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410]
  - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410]
  - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410]
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788}
  - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002}
  - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980}
  - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058}
  - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723]
  - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578]
  - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578]
  - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.63.1.el8_10]
changelog:
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154}
  - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086}
  - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932}
  - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452]
  - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452]
  - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099]
  - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099]
  - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099]
  - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.64.1.el8_10]
changelog:
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256]
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977}
  - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905}
  - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292]
  - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292]
  - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292]
  - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.65.1.el8_10]
changelog:
  - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422]
  - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.66.1.el8_10]
changelog:
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415]
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698]
  - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680}
  - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095}
  - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698]
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.67.1.el8_10]
changelog:
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}
  - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.68.1.el8_10]
changelog:
  - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}
  - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]
  - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]
  - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]
  - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]
  - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}
  - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.69.1.el8_10]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.70.1.el8_10]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717]
  - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097}
  - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600]
  - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.71.1.el8_10]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200}
  - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072]
  - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072]
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.72.1.el8_10]
changelog:
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332}
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894]
  - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313]
  - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181]
  - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369]
  - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369]
  - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464}
  - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758]
  - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758]
  - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758]
  - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758]
  - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758]
  - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758]
  - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758]
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758]
  - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758]
  - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758]
  - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758]
  - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758]
  - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758]
  - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758]
  - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758]
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758]
  - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.73.1.el8_10]
changelog:
  - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360]
  - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360]
  - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234]
  - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985}
  - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.74.1.el8_10]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.75.1.el8_10]
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812]
  - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932}
  - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392}
  - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713]
  - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160]
  - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655]
  - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655]
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.76.1.el8_10]
changelog:
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193]
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.77.1.el8_10]
changelog:
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797}
  - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609]
  - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087}
  - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.78.1.el8_10]
changelog:
  - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302]
  - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.79.1.el8_10]
changelog:
  - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305}
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.6.1.el8_10]
changelog:
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686}
  - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361]
  - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361]
  - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361]
  - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804}
  - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048]
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907}
  - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560}
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783]
  - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130]
  - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130]
  - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130]
  - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130]
  - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130]
  - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130]
  - null_blk: poll queue support (Ming Lei) [RHEL-8130]
  - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130]
  - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073}
  - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675}
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675}
  - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.7.1.el8_10]
changelog:
  - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311}
  - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813}
  - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855}
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852}
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007}
  - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456}
  - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835}
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878}
  - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877}
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781}
  - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890}
  - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700}
  - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888}
  - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366]
  - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366]
  - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397}
  - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061]
  - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669}
  - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893]
  - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893]
  - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893]
  - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893]
  - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893]
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845}
  - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838}
  - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789}
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801}
  - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584 CVE-2024-26583 CVE-2024-26585}
  - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982}
  - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626}
  - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486]
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.80.1.el8_10]
changelog:
  - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816]
  - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816]
  - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816]
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751}
  - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.81.1.el8_10]
changelog:
  - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386}
  - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841}
  - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920]
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297}
  - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111]
  - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909]
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909]
  - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909]
  - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909]
  - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909]
  - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909]
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909]
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909]
  - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909]
  - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909]
  - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909]
  - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909]
  - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909]
  - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909]
  - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909]
  - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909]
  - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909]
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909]
  - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909]
  - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909]
  - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909]
  - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909]
  - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909]
  - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909]
  - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909]
  - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909]
  - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909]
  - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909]
  - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909]
  - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909]
  - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909]
  - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909]
  - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909]
  - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909]
  - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909]
  - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909]
  - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909]
  - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909]
  - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909]
  - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909]
  - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909]
  - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909]
  - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909]
  - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909]
  - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909]
  - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909]
  - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909]
  - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909]
  - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909]
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909]
  - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909]
  - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909]
  - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909]
  - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909]
  - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909]
  - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909]
  - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909]
  - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909]
  - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909]
  - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909]
  - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909]
  - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909]
  - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909]
  - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909]
  - mm: add find_lock_head (Rafael Aquini) [RHEL-104909]
  - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909]
  - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909]
  - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909]
  - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909]
  - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909]
  - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909]
  - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909]
  - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909]
  - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909]
  - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909]
  - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909]
  - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909]
  - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909]
  - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909]
  - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909]
  - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909]
  - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909]
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849}
  - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.82.1.el8_10]
changelog:
  - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431]
  - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546]
  - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546]
  - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546]
  - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999}
  - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244}
  - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546]
  - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725}
  - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179}
  - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870}
  - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546]
  - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546]
  - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546]
  - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546]
  - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546]
  - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546]
  - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546]
  - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546]
  - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546]
  - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546]
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752}
  - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546]
  - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546]
  - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546]
  - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546]
  - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546]
  - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546]
  - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546]
  - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546]
  - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546]
  - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546]
  - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546]
  - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546]
  - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546]
  - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546]
  - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546]
  - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546]
  - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546]
  - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546]
  - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546]
  - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546]
  - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546]
  - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546]
  - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546]
  - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546]
  - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546]
  - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546]
  - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546]
  - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546]
  - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546]
  - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546]
  - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938}
  - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546]
  - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546]
  - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546]
  - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546]
  - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546]
  - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546]
  - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546]
  - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546]
  - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546]
  - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546]
  - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546]
  - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546]
  - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546]
  - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546]
  - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546]
  - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546]
  - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546]
  - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546]
  - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546]
  - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546]
  - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546]
  - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546]
  - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546]
  - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546]
  - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546]
  - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546]
  - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546]
  - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546]
  - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546]
  - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546]
  - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546]
  - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546]
  - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546]
  - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546]
  - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546]
  - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546]
  - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546]
  - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546]
  - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546]
  - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546]
  - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546]
  - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546]
  - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546]
  - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546]
  - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546]
  - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515]
  - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515]
  - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461]
  - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461]
  - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461]
  - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391]
  - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391]
  - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391]
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864}
  - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745]
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745]
  - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745]
  - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745]
  - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745]
  - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745]
  - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257}
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}
  - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.83.1.el8_10]
changelog:
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367}
  - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285]
  - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781]
  - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781]
  - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781]
  - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781]
  - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781]
  - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757]
  - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215]
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215]
  - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215]
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611]
  - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178}
  - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.84.1.el8_10]
changelog:
  - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775]
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718}
  - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.85.1.el8_10]
changelog:
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970}
  - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971}
  - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799]
  - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799]
  - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122]
  - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.86.1.el8_10]
changelog:
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825}
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237]
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724}
  - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513}
  - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921]
  - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921]
  - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921]
  - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921]
  - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.87.1.el8_10]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.88.1.el8_10]
changelog:
  - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199]
  - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539}
  - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.89.1.el8_10]
changelog:
  - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774]
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660]
  - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.91.1.el8_10]
changelog:
  - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355]
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240}
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
  - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963]
  - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171]
  - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171]
  - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226]
  - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226]
  - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744]
  - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744]
  - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744]
  - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-545.el8]
changelog:
  - tracing/timerlat: Move hrtimer_init to timerlat_fd open() (John Kacur) [RHEL-26667]
  - tracing/perf: Fix double put of trace event when init fails (Michael Petlan) [RHEL-19537]
  - ipvlan: Add handling of NETDEV_UP events (Hangbin Liu) [RHEL-19098]
  - ceph: add ceph_cap_unlink_work to fire check_caps() immediately (Xiubo Li) [RHEL-21760]
  - ceph: always queue a writeback when revoking the Fb caps (Xiubo Li) [RHEL-21760]
  - ceph: always check dir caps asynchronously (Xiubo Li) [RHEL-21760]
  - nfs: fix redundant readdir request after get eof (Benjamin Coddington) [RHEL-7780]
  - NFSv4.1: fixup use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: fix pnfs MDS=DS session trunking (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: fix zero value filehandle in post open getattr (Scott Mayhew) [RHEL-7994]
  - NFSv4.1: use EXCHGID4_FLAG_USE_PNFS_DS for DS server (Scott Mayhew) [RHEL-7994]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-546.el8]
changelog:
  - sched/membarrier: reduce the ability to hammer on sys_membarrier (Wander Lairson Costa) [RHEL-23430] {CVE-2024-26602}
  - NFS: Set the stable writes flag when initialising the super block (Benjamin Coddington) [RHEL-25266]
  - smb: client: fix OOB in receive_encrypted_standard() (Scott Mayhew) [RHEL-21685] {CVE-2024-0565}
  - scsi: core: Move scsi_host_busy() out of host lock if it is for per-command (Ming Lei) [RHEL-23942]
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler (Ming Lei) [RHEL-23942]
  - gfs2: Fix kernel NULL pointer dereference in gfs2_rgrp_dump (Andrew Price) [RHEL-26501] {CVE-2023-52448}
  - smb: client: fix parsing of SMB3.1.1 POSIX create context (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434}
  - smb: client: fix potential OOBs in smb2_parse_contexts() (Paulo Alcantara) [RHEL-26241] {CVE-2023-52434}
  - smb3: Replace smb2pdu 1-element arrays with flex-arrays (Jay Shin) [RHEL-22143]
  - cifs: Replace remaining 1-element arrays (Jay Shin) [RHEL-22143]
  - cifs: Convert struct fealist away from 1-element array (Jay Shin) [RHEL-22143]
  - cifs: remove unneeded 2bytes of padding from smb2 tree connect (Jay Shin) [RHEL-22143]
  - cifs: Replace zero-length arrays with flexible-array members (Jay Shin) [RHEL-22143]
  - cifs: Replace a couple of one-element arrays with flexible-array members (Jay Shin) [RHEL-22143]
  - cifs: fix FILE_BOTH_DIRECTORY_INFO definition (Jay Shin) [RHEL-22143]
  - nfsd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - nfs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - lockd: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - cifs: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - ceph: use locks_inode_context helper (Jeffrey Layton) [RHEL-27441]
  - filelock: add a new locks_inode_context accessor function (Jeffrey Layton) [RHEL-27441]
  - dm-integrity, dm-verity: reduce stack usage for recheck (Benjamin Marzinski) [RHEL-27849]
  - dm-crypt: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849]
  - dm-crypt: don't modify the data when using authenticated encryption (Benjamin Marzinski) [RHEL-27849]
  - dm-verity: recheck the hash after a failure (Benjamin Marzinski) [RHEL-27849]
  - dm-integrity: recheck the integrity tag after a failure (Benjamin Marzinski) [RHEL-27849]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-547.el8]
changelog:
  - x86/efistub: Avoid placing the kernel below LOAD_PHYSICAL_ADDR (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Give up if memory attribute protocol returns an error (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Increase section and file alignment to 4k/512 (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Split off PE/COFF .data section (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop PE/COFF .reloc section (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Construct PE/COFF .text section from assembler (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Derive file size from _edata symbol (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed: Remove, discard, or assert for unwanted sections (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Check that there are no run-time relocations (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Discard .discard.unreachable for arch/x86/boot/compressed/vmlinux (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Define setup size in linker script (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Set EFI handover offset directly in header asm (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop references to startup_64 (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Drop redundant code setting the root device (Lenny Szubowicz) [RHEL-2505]
  - x86/build: Declutter the build output (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Omit compression buffer from PE/COFF image memory footprint (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Mark global variables as static (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Remove extra headroom for setup block (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove the 'bugger off' message (Lenny Szubowicz) [RHEL-2505]
  - x86/efi: Drop alignment flags from PE section headers (Lenny Szubowicz) [RHEL-2505]
  - efi: Put Linux specific magic number in the DOS header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Fix the missing KASLR_FLAG bit in boot_params->hdr.loadflags (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Avoid physical KASLR on older Dell systems (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: efistub: Assign global boot_params variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Rename conflicting 'boot_params' pointer to 'boot_params_ptr' (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Avoid legacy decompressor when doing EFI boot (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Perform SNP feature test while running in the firmware (Lenny Szubowicz) [RHEL-2505]
  - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub: Add limit argument to efi_random_alloc() (Lenny Szubowicz) [RHEL-2505]
  - arm64: efi: Limit allocations to 48-bit addressable physical region (Lenny Szubowicz) [RHEL-2505]
  - efi: libstub: use EFI_LOADER_CODE region when moving the kernel in memory (Lenny Szubowicz) [RHEL-2505]
  - arm64: efi: kaslr: Fix occasional random alloc (and boot) failure (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/random: Increase random alloc granularity (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Factor out kernel decompression and relocation (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Move global symbol references to C code (Lenny Szubowicz) [RHEL-2505]
  - decompress: Use 8 byte alignment (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Prefer EFI memory attributes protocol over DXE services (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Perform 4/5 level paging switch from the stub (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Merge trampoline cleanup with switching code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Pass pgtable address to trampoline directly (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Only call the trampoline when changing paging levels (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Call trampoline directly from C code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Avoid the need for a stack in the 32-bit trampoline (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Use standard calling convention for trampoline (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Call trampoline as a normal function (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Remove .bss/.pgtable from bzImage (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove run-time relocations from .head.text code (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Assign paging related global variables earlier (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Clear BSS in EFI handover protocol entrypoint (Lenny Szubowicz) [RHEL-2505]
  - x86/head_64: Store boot_params pointer in callee save register (Lenny Szubowicz) [RHEL-2505]
  - x86/decompressor: Don't rely on upper 32 bits of GPRs being preserved (Lenny Szubowicz) [RHEL-2505]
  - x86/head/64: Switch to KERNEL_CS as soon as new GDT is installed (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub: Add memory attribute protocol definitions (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: libstub: remove unused variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Robustify calling startup_{32,64}() from the decompressor code (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Simplify and clean up handover entry code (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Branch straight to kernel entry point from C code (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Avoid using code32_start (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Use Exit() boot service to exit the stub on errors (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Wipe setup_data on pure EFI boot (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Fix config name for setting the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505]
  - efi: x86: Set the NX-compatibility flag in the PE header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Add kernel preferred address to PE header (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Use symbolic constants in PE header instead of bare numbers (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Drop redundant .bss section (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: add headroom to decompressor BSS to account for setup block (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove run-time relocations from head_{32,64}.S (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed: Fix debug_puthex() parameter type (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Use 32-bit (zero-extended) MOV for z_output_len (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Use unsigned comparison for addresses (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Micro-optimize GDT loading instructions (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: GDT limit value should be size - 1 (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Remove GDT setup from efi_main (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Clear direction and interrupt flags in startup_64 (Lenny Szubowicz) [RHEL-2505]
  - efi/x86: Don't depend on firmware GDT layout (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Remove KEEP_SEGMENTS support (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Handle malformed SRAT tables during early ACPI parsing (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Use mandatory 16-byte stack alignment in mixed mode (Lenny Szubowicz) [RHEL-2505]
  - efi/libstub/x86: Avoid globals to store context during mixed mode calls (Lenny Szubowicz) [RHEL-2505]
  - x86/efistub: Disable paging at mixed mode entry (Lenny Szubowicz) [RHEL-2505]
  - x86: efi/random: Invoke EFI_RNG_PROTOCOL to seed the UEFI RNG table (Lenny Szubowicz) [RHEL-2505]
  - x86/asm: Make some functions local (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Annotate data appropriately (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Annotate local functions (Lenny Szubowicz) [RHEL-2505]
  - x86/asm: Make more symbols local (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Fix missing initialization in find_trampoline_placement() (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Fix boot on machines with broken E820 table (Lenny Szubowicz) [RHEL-2505]
  - x86, boot: Remove multiple copy of static function sanitize_boot_params() (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Remove unused variable (Lenny Szubowicz) [RHEL-2505]
  - x86/boot/compressed/64: Explain paging_prepare()'s return value (Lenny Szubowicz) [RHEL-2505]
  - x86/boot: Save several bytes in decompressor (Lenny Szubowicz) [RHEL-2505]
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super (Audra Mitchell) [RHEL-20614] {CVE-2024-0841}
  - net/gve: update check for little-endianness in gve kconfig (Joshua Washington) [RHEL-29030]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-548.el8]
changelog:
  - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann)
  - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005]
  - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214]
  - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-74.el8]
changelog:
  - [x86] revert "cpu/hotplug: Add SMT policy options" (Josh Poimboeuf) [1683690]
  - [crypto] net: crypto set sk to NULL when af_alg_release (Neil Horman) [1679450] {CVE-2019-8912}
  - [drm] drm/i915/gvt: update force-to-nonpriv register whitelist (Paul Lai) [1643972]
  - [kernel] MODSIGN: Also check platform keyring in mod_verify_sig() (Lenny Szubowicz) [1568532]
  - [kernel] Fix for module sig verification (Lenny Szubowicz) [1568532]
  - [security] efi: Lock down the kernel if booted in secure boot mode (Lenny Szubowicz) [1568532]
  - [firmware] efi: Add an EFI_SECURE_BOOT flag to indicate secure boot mode (Lenny Szubowicz) [1568532]
  - [x86] Copy secure_boot flag in boot params across kexec reboot (Lenny Szubowicz) [1568532]
  - [fs] debugfs: Restrict debugfs when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [mm] x86/mmiotrace: Lock down the testmmiotrace module (Lenny Szubowicz) [1568532]
  - [kernel] Lock down module params that specify hardware parameters (eg. ioport) (Lenny Szubowicz) [1568532]
  - [tty] Lock down TIOCSSERIAL (Lenny Szubowicz) [1568532]
  - [pcmcia] Prohibit PCMCIA CIS storage when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Disable ACPI table override if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [acpi] acpi: Ignore acpi_rsdp kernel param when the kernel has been locked down (Lenny Szubowicz) [1568532]
  - [acpi] ACPI: Limit access to custom_method when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86/msr: Restrict MSR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [x86] x86: Lock down IO port access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [pci] PCI: Lock down BAR access when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] uswsusp: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] hibernate: Disable when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] kexec_load: Disable at runtime if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [char] Restrict /dev/{mem, kmem, port} when the kernel is locked down (Lenny Szubowicz) [1568532]
  - [kernel] MODSIGN: Enforce module signatures if the kernel is locked down (Lenny Szubowicz) [1568532]
  - [security] Add a SysRq option to lift kernel lockdown (Lenny Szubowicz) [1568532]
  - [security] Add the ability to lock down access to the running kernel image (Lenny Szubowicz) [1568532]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-75.el8]
changelog:
  - [netdrv] net: hns3: add 8 BD limit for tx flow (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: fix a SSU buffer checking bug (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: aligning buffer size in SSU to 256 bytes (Xiaojun Tan) [1676771]
  - [netdrv] net: hns3: getting tx and dv buffer size through firmware (Xiaojun Tan) [1676771]
  - [net] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs (Florian Westphal) [1676602]
  - [char] ipmi: fix use-after-free of user->release_barrier.rda (Xiaojun Tan) [1677550]
  - [char] ipmi: Prevent use-after-free in deliver_response (Xiaojun Tan) [1677550]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-76.el8]
changelog:
  - [security] revert "Add a SysRq option to lift kernel lockdown" (Lenny Szubowicz) [1684348]
  - [s390] s390/setup: fix boot crash for machine without EDAT-1 (Philipp Rudo) [1677357]
  - [s390] s390/setup: fix early warning messages (Philipp Rudo) [1677357]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-77.el8]
changelog:
  - [firmware] efi: Reduce the amount of memblock reservations for persistent allocations (Bhupesh Sharma) [1682988]
  - [firmware] efi: Permit multiple entries in persistent memreserve data structure (Bhupesh Sharma) [1682988]
  - [kernel] cpu/hotplug: Create SMT sysfs interface for all arches (Josh Poimboeuf) [1686068]
  - [net] netfilter: nft_set_hash: bogus element self comparison from deactivation path (Florian Westphal) [1678574]
  - [net] netfilter: nft_set_hash: fix lookups with fixed size hash on big endian (Florian Westphal) [1678574]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-79.el8]
changelog:
  - [firmware] drivers/firmware: psci_checker: stash and use topology_core_cpumask for hotplug tests (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: re-introduce numa mask check for scheduler MC selection (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: rename llc_siblings to align with other struct members (Josh Poimboeuf) [1687101]
  - [arm64] arm64: smp: remove cpu and numa topology information when hotplugging out CPU (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: restrict updating siblings_masks to online cpus only (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: add support to remove cpu topology sibling masks (Josh Poimboeuf) [1687101]
  - [arm64] arm64: numa: separate out updates to percpu nodeid and NUMA node cpumap (Josh Poimboeuf) [1687101]
  - [arm64] arm64: topology: refactor reset_cpu_topology to add support for removing topology (Josh Poimboeuf) [1687101]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.el8]
changelog:
  - [arm64] revert "arm64: tlb: Avoid synchronous TLBIs when freeing page tables" (Christoph von Recklinghausen) [1685697]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.1.2.el8_0]
changelog:
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1690338 1690360 1690351] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.3.1.el8_0]
changelog:
  - [mm] mm: enforce min addr even if capable() in expand_downwards() (Rafael Aquini) [1708829 1687667] {CVE-2019-9213}
  - [powerpc] powerpc/radix: Fix kernel crash with mremap() (Steve Best) [1708617 1674186]
  - [powerpc] powerpc/security: Fix spectre_v2 reporting (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/powernv: Query firmware for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/pseries: Query hypervisor for count cache flush settings (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add support for software count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64s: Add new security feature flags for count cache flush (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/asm: Add a patch_site macro & helpers for patching instructions (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Call setup_barrier_nospec() from setup_arch() (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc/64: Add CONFIG_PPC_BARRIER_NOSPEC (Gustavo Duarte) [1708112 1694456]
  - [powerpc] powerpc64s: Show ori31 availability in spectre_v1 sysfs file not v2 (Gustavo Duarte) [1708112 1694456]
  - [of] of: __of_detach_node() - remove node from phandle cache (Steve Best) [1708102 1669198]
  - [of] of: of_node_get()/of_node_put() nodes held in phandle cache (Steve Best) [1708102 1669198]
  - [fs] debugfs: Fix EPERM regression from kernel lockdown check (Lenny Szubowicz) [1708100 1686755]
  - [block] nvme: lock NS list changes while handling command effects (David Milburn) [1701140 1672759]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.1.el8_0]
changelog:
  - [netdrv] ice: Do autoneg based on VSI state (Jonathan Toppins) [1709433 1687903]
  - [arm64] arm64: apply workaround on A64FX v1r0 (Mark Langsdorf) [1700901 1692306]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [s390] s390/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [powerpc] powerpc/64: Disable the speculation barrier from the command line (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add 'mitigations=' support for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] cpu/speculation: Add 'mitigations=' cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Print SMT vulnerable on MSBDS with mitigations off (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Fix comment (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add SMT warning message (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Move arch_smt_update() call to after mitigation decisions (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds=full, nosmt cmdline option (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Add MDS vulnerability documentation (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [documentation] Documentation: Move L1TF to separate directory (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation mode VMWERV (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add sysfs reporting for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mitigation control for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Conditionally clear CPU buffers on idle entry (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/kvm/vmx: Add MDS protection when L1D Flush is not active (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Clear CPU buffers on exit to user (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add mds_clear_cpu_buffers() (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kvm] x86/kvm: Expose X86_FEATURE_MD_CLEAR to guests (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add BUG_MSBDS_ONLY (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation/mds: Add basic bug infrastructure for MDS (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Consolidate CPU whitelists (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/msr-index: Cleanup bit defines (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/speculation: Cast ~SPEC_CTRL_STIBP atomic value to int (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [x86] x86/cpu: Sanitize FAM6_ATOM naming (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [include] locking/atomics, asm-generic: Move some macros from <linux/bitops.h> to a new <linux/bits.h> file (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [tools] tools include: Adopt linux/bits.h (Josh Poimboeuf) [1698809 1698896 1699001 1705836 1690338 1690360 1690351 1705312] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.5.1.el8_0]
changelog:
  - [kernel] sched/fair: Limit sched_cfs_period_timer() loop to avoid hard lockup (Joel Savitz) [1715345 1695651]
  - [kernel] sched/fair: Fix O(nr_cgroups) in the load balancing path (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix insertion in rq->leaf_cfs_rq_list (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Add tmp_alone_branch assertion (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [kernel] sched/fair: Fix infinite loop in update_blocked_averages() by reverting a9e7f6544b9c (Phil Auld) [1715343 1685636] {CVE-2018-20784}
  - [rpmspec] apply linux-kernel-test.patch when building ("Herton R. Krzesinski") [1715340 1690534]
  - [rpmspec] Fix cross builds (Jiri Olsa) [1715339 1694956]
  - [kernel] sched/fair: Do not re-read ->h_load_next during hierarchical load calculation (Phil Auld) [1715337 1701762]
  - [kvm] KVM: PPC: Book3S HV: Save/restore vrsave register in kvmhv_p9_guest_entry() (Suraj Jitindar Singh) [1714753 1700272]
  - [powerpc] KVM: PPC: Book3S HV: Perserve PSSCR FAKE_SUSPEND bit on guest exit (Suraj Jitindar Singh) [1714751 1689768]
  - [powerpc] powerpc/powernv/ioda: Fix locked_vm counting for memory used by IOMMU tables (David Gibson) [1714746 1674410]
  - [char] ipmi_si: fix use-after-free of resource->name (Tony Camuso) [1714409 1714410] {CVE-2019-11811}
  - [x86] Update stepping values for coffee lake desktop (David Arcari) [1711048 1704800]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.6.1.el8_0]
changelog:
  - [mm] mm: defer ZONE_DEVICE page initialization to the point where we init pgmap (Waiman Long) [1719635 1666538]
  - [mm] mm: create non-atomic version of SetPageReserved for init use (Waiman Long) [1719635 1666538]
  - [mm] mm: provide kernel parameter to allow disabling page init poisoning (Waiman Long) [1719635 1666538]
  - [mm] mm, slub: restore the original intention of prefetch_freepointer() (Rafael Aquini) [1718237 1714671]
  - [security] selinux: do not report error on connect(AF_UNSPEC) (Ondrej Mosnacek) [1717870 1707828]
  - [security] selinux: Check address length before reading address family (Ondrej Mosnacek) [1717870 1707828]
  - [powerpc] powerpc/tm: Fix stack pointer corruption (Desnes Augusto Nunes do Rosario) [1717869 1707635]
  - [md] dm cache metadata: Fix loading discard bitset (Mike Snitzer) [1717868 1701618]
  - [md] dm mpath: fix missing call of path selector type->end_io (Mike Snitzer) [1717804 1686227]
  - [mm] mm/memory.c: do_fault: avoid usage of stale vm_area_struct ("Herton R. Krzesinski") [1717801 1684734]
  - [net] sunrpc: fix 4 more call sites that were using stack memory with a scatterlist (Scott Mayhew) [1717800 1679183]
  - [net] sunrpc: Don't use stack buffer with scatterlist (Scott Mayhew) [1717800 1679183]
  - [scsi] scsi: mpt3sas: Fix kernel panic during expander reset (Tomas Henzl) [1717791 1677693]
  - [security] selinux: always allow mounting submounts (Ondrej Mosnacek) [1717777 1647723]
  - [drm] drm/bufs: Fix Spectre v1 vulnerability (Rob Clark) [1717382 1663467]
  - [drm] drm/ioctl: Fix Spectre v1 vulnerabilities (Rob Clark) [1717382 1663467]
  - [tools] perf annotate: Fix getting source line failure (Michael Petlan) [1716887 1614435]
  - [iommu] iommu/amd: Set exclusion range correctly (Jerry Snitselaar) [1715336 1702766]
  - [iommu] iommu/amd: Reserve exclusion range in iova-domain (Jerry Snitselaar) [1717344 1694835]
  - [kvm] KVM: PPC: Book3S: Add count cache flush parameters to kvmppc_get_cpu_char() (Vitaly Kuznetsov) [1715018 1694456]
  - [s390] kvm: s390: Fix potential spectre warnings (Thomas Huth) [1714754 1702344]
  - [drm] drm/i915/gvt: Fix mmap range check (Alex Williamson) [1713572 1713573] {CVE-2019-11085}
  - [scsi] scsi: megaraid_sas: return error when create DMA pool failed (Tomas Henzl) [1712862 1712863] {CVE-2019-11810}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.1.el8_0]
changelog:
  - [x86] Update stepping values for Whiskey Lake U/Y (David Arcari) [1722372 1704801]
  - [x86] x86/perf/amd: Resolve NMI latency issues for active PMCs (David Arcari) [1722367 1640238]
  - [x86] x86/perf/amd: Resolve race condition when disabling PMC (David Arcari) [1722367 1640238]
  - [edac] EDAC/amd64: Set maximum channel layer size depending on family (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Adjust printed chip select sizes when interleaved (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Recognize x16 symbol size (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Support more than two Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Use a macro for iterating over Unified Memory Controllers (Gary Hook) [1722365 1690984]
  - [edac] EDAC, amd64: Add Family 17h, models 10h-2fh support (Gary Hook) [1722365 1690984]
  - [edac] EDAC/amd64: Add Family 17h Model 30h PCI IDs (Aristeu Rozanski) [1722365 1696603]
  - [x86] mark AMD Rome processors supported (David Arcari) [1721972 1520002]
  - [x86] x86/mce: Handle varying MCA bank counts (David Arcari) [1721233 1668779]
  - [iommu] iommu/vt-d: Disable ATS support on untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [documentation] thunderbolt: Export IOMMU based DMA protection support to userspace (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Do not enable ATS for untrusted devices (Jerry Snitselaar) [1700376 1692246]
  - [iommu] iommu/vt-d: Force IOMMU on for platform opt in hint (Jerry Snitselaar) [1700376 1692246]
  - [pci] PCI / ACPI: Identify untrusted PCI devices (Myron Stowe) [1700376 1704979]
  - [acpi] ACPI / property: Allow multiple property compatible _DSD entries (Myron Stowe) [1700376 1537397]
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.8.1.el8_0]
changelog:
  - [documentation] Documentation: Add ARM64 to kernel-parameters.rst (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbs: Don't treat CPUs with SSBS as unaffected by SSB (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: enable generic CPU vulnerabilites support (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for speculative store bypass (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable ssb vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Always enable spectre-v2 vulnerability detection (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use firmware to detect CPUs that are not affected by Spectre-v2 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Advertise mitigation of Spectre-v2, or lack thereof (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: add sysfs vulnerability show for meltdown (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add sysfs vulnerability show for spectre-v1 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Provide a command line to disable spectre_v2 mitigation (Jeremy Linton) [1726353 1640855]
  - [documentation] powerpc/fsl: Add FSL_PPC_BOOK3E as supported arch for nospectre_v2 boot arg (Jeremy Linton) [1726353 1640855]
  - [documentation] Documentation: Document arm64 kpti control (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist HiSilicon Taishan v110 CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Add MIDR encoding for HiSilicon Taishan CPUs (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Whitelist Cortex-A CPUs that don't implement the CSV3 field (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Update arm64_kernel_use_ng_mappings() when forced on (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: kpti: Avoid rewriting early page tables when KASLR is enabled (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge duplicate Cavium erratum entries (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: capabilities: Merge entries for ARM64_WORKAROUND_CLEAN_CACHE (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: Use a raw spinlock in __install_bp_hardening_cb() (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: KVM: Guests can skip __install_bp_hardening_cb()s HYP work (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: fix SSBS sanitization (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: don't zero DIT on signal return (Jeremy Linton) [1726353 1640855]
  - [kvm] KVM: arm64: Set SCTLR_EL2.DSSBS if SSBD is forcefully disabled and !vhe (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Add support for PSTATE.SSBS rather than trapping to EL3 (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: ssbd: Drop #ifdefs for PR_SPEC_STORE_BYPASS (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: cpufeature: Detect SSBS and advertise to userspace (Jeremy Linton) [1726353 1640855]
  - [arm64] arm64: move SCTLR_EL{1,2} assertions to <asm/sysreg.h> (Jeremy Linton) [1726353 1640855]
  - Revert: [arm64] arm64/speculation: Support 'mitigations=' cmdline option (Josh Poimboeuf) [1726353 1640855] {CVE-2018-12130 CVE-2018-12127 CVE-2018-12126 CVE-2019-11091}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.9.1.el8_0]
changelog:
  - [netdrv] thunderx: eliminate extra calls to put_page() for pages held for recycling (Dean Nelson) [1726354 1644011]
  - [netdrv] thunderx: enable page recycling for non-XDP case (Dean Nelson) [1726354 1644011]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean also when kaslr is off (Mark Salter) [1726357 1673068]
  - [arm64] arm64: kaslr: ensure randomized quantities are clean to the PoC (Mark Salter) [1726357 1673068]
  - [mm] powerpc/mm/64s/hash: Reallocate context ids on fork (Gustavo Duarte) [1734689 1723808] {CVE-2019-12817}
  - [powerpc] powerpc/pseries/mobility: rebuild cacheinfo hierarchy post-migration (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/pseries/mobility: prevent cpu hotplug during DT update (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/cacheinfo: add cacheinfo_teardown, cacheinfo_rebuild (Steve Best) [1733282 1720929]
  - [powerpc] powerpc/watchpoint: Restore NV GPRs while returning from exception (Steve Best) [1733281 1728557]
  - [hid] HID: i2c-hid: Don't reset device upon system resume (Perry Yuan) [1727098 1715385]
  - [netdrv] net/mlx5e: RX, Verify MPWQE stride size is in range (Alaa Hleihel) [1726372 1683589]
  - [sound] ALSA: usb-audio: Fix UAF decrement if card has no live interfaces in card.c (Jaroslav Kysela) [1726371 1658924] {CVE-2018-19824}
  - [sound] ALSA: hda - Enable runtime PM only for discrete GPU (Jaroslav Kysela) [1726361 1714817]
  - [cpufreq] cpufreq: intel_pstate: Ignore turbo active ratio in HWP (David Arcari) [1726360 1711970]
  - [infiniband] usnic_verbs: fix deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix locking when unregistering (Govindarajulu Varadarajan) [1726358 1688505]
  - [infiniband] IB/usnic: Fix potential deadlock (Govindarajulu Varadarajan) [1726358 1688505]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [netdrv] igb: shorten maximum PHC timecounter update interval (Corinna Vinschen) [1726352 1637098]
  - [x86] x86/platform/UV: Use efi_runtime_lock to serialise BIOS calls (Frank Ramsay) [1724534 1677695]
  - [security] selinux: overhaul sidtab to fix bug and improve performance (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: use separate table for initial SID lookup (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: refactor sidtab conversion (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in sidtab (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in services (Ondrej Mosnacek) [1717780 1656787]
  - [security] selinux: Cleanup printk logging in policydb (Ondrej Mosnacek) [1717780 1656787]
  - [crypto] crypto: authenc - fix parsing key with misaligned rta_len (Herbert Xu) [1715335 1707546]
  - [mm] mm, page_alloc: fix has_unmovable_pages for HugePages (David Gibson) [1714758 1688114]
  - [wireless] mwifiex: Abort at too short BSS descriptor element (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [wireless] mwifiex: Fix possible buffer overflows at parsing bss descriptor (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}
  - [nvme] nvme-pci: add missing unlock for reset error (Gopal Tiwari) [1712261 1703201]
  - [nvme] nvme-pci: fix rapid add remove sequence (Gopal Tiwari) [1712261 1703201]
  - [wireless] brcmfmac: add subtype check for event handling in data path (Stanislaw Gruszka) [1733895 1704684] {CVE-2019-9503}
  - [wireless] brcmfmac: assure SSID length from firmware is limited (Stanislaw Gruszka) [1705385 1705386] {CVE-2019-9500}
  - [include] fs: fix kABI for struct pipe_buf_operations (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fs: prevent page refcount overflow in pipe_buf_get (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [mm] mm: prevent get_user_pages() from overflowing page refcount (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: add 'try_get_page()' helper function (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [include] mm: make page ref count overflow check tighter and more explicit (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [fs] fuse: call pipe_buf_release() under pipe lock (Miklos Szeredi) [1705006 1705007] {CVE-2019-11487}
  - [kvm] KVM: x86: nVMX: fix x2APIC VTPR read intercept (Vitaly Kuznetsov) [1697198 1697199]
  - [kvm] KVM: x86: nVMX: close leak of L0's x2APIC MSRs (CVE-2019-3887) (Vitaly Kuznetsov) [1697198 1697199]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.10.1.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.11.1.el8_0]
changelog:
  - [wireless] mwifiex: Don't abort on small, spec-compliant vendor IEs (Jarod Wilson) [1714475 1728992]
  - [wireless] mwifiex: fix 802.11n/WPA detection (Jarod Wilson) [1714475 1714476] {CVE-2019-3846}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.2.1.el8_0]
changelog:
  - [netdrv] qed: Fix qed_mcp_halt|resume() (Manish Chopra) [1704184 1697310]
  - [cpufreq] cpufreq: intel_pstate: Also use CPPC nominal_perf for base_frequency (Prarit Bhargava) [1706739 1696131]
  - [acpi] ACPI / CPPC: Fix guaranteed performance handling (Prarit Bhargava) [1706739 1696131]
  - [arm64] arm64: Add workaround for Fujitsu A64FX erratum 010001 (Mark Langsdorf) [1700902 1666951]
  - [s390] vfio_ap: link the vfio_ap devices to the vfio_ap bus subsystem (Cornelia Huck) [1700290 1686044]
  - [netdrv] net/mlx4_en: Force CHECKSUM_NONE for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [netdrv] net/mlx5e: Force CHECKSUM_UNNECESSARY for short ethernet frames (Alaa Hleihel) [1700289 1651509]
  - [pci] PCI: pciehp: Fix re-enabling the slot marked for safe removal (Myron Stowe) [1700288 1695922]


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.4.2.el8_0]
changelog:
  - [net] tcp: enforce tcp_min_snd_mss in tcp_mtu_probing() (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: add tcp_min_snd_mss sysctl (Florian Westphal) [1719922 1719923] {CVE-2019-11479}
  - [net] tcp: tcp_fragment() should apply sane memory limits (Florian Westphal) [1719857 1719858] {CVE-2019-11478}
  - [net] tcp: limit payload size of sacked skbs (Florian Westphal) [1719602 1719603] {CVE-2019-11477}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-80.7.2.el8_0]
changelog:
  - [x86] x86/entry/64: Use JMP instead of JMPQ (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Enable Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/speculation: Prepare entry code for Spectre v1 swapgs mitigations (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Combine word 11 and 12 into a new scattered features word (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [x86] x86/cpufeatures: Carve out CQM features retrieval (Josh Poimboeuf) [1724500 1724501] {CVE-2019-1125}
  - [kernel] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME (Aristeu Rozanski) [1730958 1730959] {CVE-2019-13272}


author: Frantisek Hrbata <fhrbata@redhat.com> [4.18.0-73.el8]
changelog:
  - [net] tun: forbid iface creation with rtnl ops (Sabrina Dubroca) [1680969]
  - [net] revert "bridge: do not add port to router list when receives query with source 0.0.0.0" (Hangbin Liu) [1679896]
  - [net] sctp: walk the list of asoc safely (Marcelo Leitner) [1679920] {CVE-2019-8956}
  - [net] netfilter: nf_nat: skip nat clash resolution for same-origin entries (Florian Westphal) [1677647]
  - [net] netfilter: nf_conntrack: resolve clash for matching conntracks (Florian Westphal) [1677647]
  - [net] netfilter: nf_tables: fix flush after rule deletion in the same batch (Phil Sutter) [1677672]
  - [net] gro_cell: add napi_disable in gro_cells_destroy (Stefano Brivio) [1674408]
  - [net] sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment (Xin Long) [1669386]
  - [net] ipvs: fix dependency on nf_defrag_ipv6 (Andrea Claudi) [1660808]
  - [net] sctp: check and update stream->out_curr when allocating stream_out (Xin Long) [1651877]


author: Ilya Okomin <ilya.okomin@oracle.com> - [4.18.0-80.el8.OL8]
changelog:
  - Fix Oracle Linux RHCK Module Signing Key addition to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
  - Oracle Linux certificates (Alexey Petrenko)
  - Oracle Linux RHCK Module Signing Key was compiled into kernel (olkmod_signing_key.x509)(alexey.petrenko@oracle.com)
  - Update x509.genkey [Orabug: 24817676]


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-5
changelog:
  - weak-modules: handle versions with + and other special regex symbols
  - weak-modules: fix misleading message when cannot find dracut.
    Resolves: rhbz#1609372.


author: Eugene Syromiatnikov <esyr@redhat.com> - 25-6
changelog:
  - weak-modules: check also for /lib/modules/$krel/symvers.gz as a possible
    symvers file path.
    Resolves: rhbz#1614119.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-7
changelog:
  - weak-modules: use is_kernel_installed wrapper in update_modules_for_krel.
  - weak-modules: more abstract symvers search implementation.
  - weak-modules: use additional paths for System.map file.
    Resolves: rhbz#1621306.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-8
changelog:
  - weak-modules: fix initial state creation for dry-run
  - weak-modules: check compatibility in a temporary directory
    Resolves: rhbz#1622990.


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: EL Errata <el-errata_ww@oracle.com> - 25-20.0.1
changelog:
  - weak-modules: Fix add_kernel to handle suffix [Orabug: 34623248] (Todd Vierling)
  - add weak-modules patch for [Orabug: 26672773]


author: Fabio M. Di Nitto <fdinitto@redhat.com> - 1.10-3
changelog:
  PMTUd: Fix MTU calculation when using crypto
    Resolves: rhbz#1736872
    host: Fix defrag buffer reclaim logic that could cause delivery
          of corrupted data
    ResolveS: rhbz#1761711


author: Christine Caulfield <ccaulfie@redhat.com> - 1.22-1
changelog:
  Rebase to 1.22
    Resolves: rhbz#1999976

    * Wed Sep 23 2020 Christine Caulfield <ccaulfie@redhat.com> - 1.18-1
    Rebase to 1.18
    Resolves: rhbz#1855301


author: Christine Caulfield <ccaulfie@redhat.com> - 1.25-1
changelog:
  Rebase to 1.25 for PMTUd fixes
    Resolves: rhbz#2161172

    * Wed Jul 27 2022 Christine Caulfield <ccaulfie@redhat.com> - 1.24-2
    Don't run nozzle_up_down tests, as they don't work in RH CI
    Resolves: rhbz#2024095


author: Madison Kelly <mkelly@alteeve.ca> - 1.1-4
changelog:
  - Removed leading spaces from descriptions.
  - Added the (commented out) %check tests.
  - Updated the changelog macro references to have two percent signs.
  - Dropped the redundant libknet1-devel license files.
  - Changed 'GPLv2+ + LGPLv2+' to 'GPLv2+ and LGPLv2+'.
  - Updated %ldconfig_scriptlets call.
  - Clarified the kronosnet protocol version in the summary.


author: Madison Kelly <mkelly@alteeve.ca> - 1.1-8
changelog:
  - Changed pkgconfig() to normal package names to help avoid the wrong
    package being pulled in to satisfy dependencies.


author: Tomas Orsava <torsava@redhat.com> - 2.6.0-5
changelog:
  - Require the Python interpreter directly instead of using the package name
  - Resolves: rhbz#1633617


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-7
changelog:
  - Resolves: rhbz#1634268 - ECP signature check fails with
                             LASSO_DS_ERROR_SIGNATURE_NOT_FOUND when
                             assertion signed instead of response


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-8
changelog:
  - Resolves: rhbz#1730018 - lasso includes "Destination" attribute in SAML
                             AuthnRequest populated with SP
                             AssertionConsumerServiceURL when ECP workflow
                             is used which leads to IdP-side errors


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-9
changelog:
  - Resolves: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (coming
                             from lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-10
changelog:
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-11
changelog:
  - Bump release to force the package through OSCI as the previous
    build reached CI just in time for an outage
  - Related: rhbz#1888195 - [RFE] release (built) python3-lasso pkg (comingfrom lasso)


author: Jakub Hrozek <jhrozek@redhat.com> - 2.6.0-12
changelog:
  - Fix a dead code issue in the signature wrapping patch
  - Resolves: rhbz#1951653 - CVE-2021-28091 lasso: XML signature wrapping
                             vulnerability when parsing SAML responses [rhel-8]


author: Tomas Halman <thalman@redhat.com> - 2.6.0-14
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126687 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: Rex Dieter <rdieter@fedoraproject.org> - 2.7-4
changelog:
  - %files: less globs, use %license
  - tighten subpkg deps
  - -devel: use %doc
  - use %version in Source URL
  - simplify %setup
  - %check: make check


author: Petr Menšík <pemensik@redhat.com> - 1.7.0-14
changelog:
  - Add only extra flags to default RPM LDFLAGS
  - Fix multilib conflict of ldns-config (#1463423)
  - Make primary python3 in primary build, python2 in optional


author: Dominik 'Rathann' Mierzejewski <rpm@greysector.net> 1.0.9-1
changelog:
  - update to 1.0.9
  - use license macro
  - tighten file list wildcards
  - switch to https for source URL


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 12.10.0-17
changelog:
  - Python 2 binary package renamed to python2-appindicator
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Richard Hughes <richard@hughsie.com> 0.7.8-1
changelog:
  - New upstream release
  - Add as_version_string() for fwupd
  - Add support for component agreements
  - Correctly compare version numbers like '1.2.3' and '1.2.3a'
  - Don't include the path component in the name when parsing the package filename
  - If the launchable is specified don't guess it when composing
  - Never add more than one component to the AppStream store when composing


author: Richard Hughes <richard@hughsie.com> 0.7.9-1
changelog:
  - New upstream release
  - Convert local icons found in metainfo files
  - Follow the Debian tilde usage when ordering versions
  - Use the launchable to find the desktop filename


author: Richard Hughes <richard@hughsie.com> 0.7.10-1
changelog:
  - New upstream release
  - Do not parse firmware files anymore
  - Do not require a release transaction when validating in relaxed mode
  - Extract release descriptions and agreement sections for translation


author: Richard Hughes <richard@hughsie.com> 0.7.11-1
changelog:
  - New upstream release
  - Add AS_APP_QUIRK_DEVELOPER_VERIFIED
  - Escape quotes in attributes
  - Provide async variants of store load functions


author: Richard Hughes <richard@hughsie.com> 0.7.13-1
changelog:
  - New upstream release
  - Do not restrict the maximum number of releases allowed
  - Throw an error when a launchable desktop-id is invalid


author: Richard Hughes <richard@hughsie.com> 0.7.14-1
changelog:
  - New upstream release
  - Add new API for gnome-software
  - Set the AppStream ID from the X-Flatpak desktop key


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.1-1
changelog:
  - the latest release, per release notes:
    https://groups.google.com/forum/#!topic/libarchive-discuss/jfc7lBfrvVg


author: Pavel Raiskup <praiskup@redhat.com> - 3.3.2-4
changelog:
  - fix out-of-bounds read within lha_read_data_none() (CVE-2017-14503)
  - fix crash on crafted 7zip archives (CVE-2019-1000019)
  - fix infinite loop in ISO9660 (CVE-2019-1000020)


author: Ondrej Dubaj <odubaj@redhat.com> - 3.3.2-7
changelog:
  - fix use-after-free in delayed newc link processing (#1602575)
  - fix a few obvious resource leaks and strcpy() misuses (#1602575)


author: Lukas Javorsky <ljavorsk@redhat.com> - 3.3.3-6
changelog:
  - Resolves: CVE-2025-5914
  - Skip compression-level=1 size check on s390x.
  - Related to https://github.com/libarchive/libarchive/issues/1515


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-7
changelog:
  - Use major/minor macros from sys/sysmacros.h instead of linux/kdev_t.h (vtrefny)
    Resolves: rhbz#1644825


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-9
changelog:
  - Remove device-mapper-multipath dependency from fs and part plugins (vtrefny)
    Resolves: rhbz#1700297


author: Vojtech Trefny <vtrefny@redhat.com> - 2.19-12
changelog:
  - Use cryptsetup to check LUKS2 label
    Resolves: rhbz#1778689
  - Fix expected cache pool name with newest LVM
    Related: rhbz#1778689


author: Robert Scheck <robert@fedoraproject.org> 1.4.4-1
changelog:
  - Update to upstream 1.4.4 (#1352496)
  - Reworked spec file to build libburn1 for RHEL >= 6 (#750009)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.1-1
changelog:
  - Add NEWS.rst file (vtrefny)
  - Fix source and url in spec file (vtrefny)
  - Use only one git tag for new releases (vtrefny)
  - Actually translate the units when expected (vpodzime)
  - Add two temporary test files to .gitignore (vpodzime)


author: Vratislav Podzimek <vpodzime@redhat.com> - 1.2-1
changelog:
  - Use only version as a tag of the last release (vpodzime)
  - Do not require the glib-2.0 pkgconfig package (vpodzime)
  - Do not lie about tag creation (vpodzime)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.3-1
changelog:
  - Allow building libbytesize without Python 2 support (vtrefny)
  - Sync spec with downstream (vtrefny)
  - Add gcc to BuildRequires (vtrefny)
  - Fix links for documentation and GH project (vtrefny)
  - Add a HACKING.rst file (vpodzime)
  - Do not segfault when trying to bs_size_free NULL (vtrefny)


author: Vojtech Trefny <vtrefny@redhat.com> - 1.4-1
changelog:
  - Squashed 'translation-canary/' changes from 840c2d6..fccbb1b (vtrefny)
  - Make sure the test script fails if one of the test runs fail (vtrefny)
  - Do not try to run python2 tests without python2 support (vtrefny)
  - Fix licence header for "gettext.h" (vtrefny)
  - Do not use rpm to check for Zanata client (vtrefny)
  - Use new ldconfig_scriptlets macro in spec (vtrefny)


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.1.16-1
changelog:
  - Update to 0.1.16
  - Make inline function __comps_objmrtree_all also static (RhBug:1793424)
  - Fix memory leaks and resource leaks
  - Fix: Check result "comps_parse_parsed_init()"


author: Kalev Lember <klember@redhat.com> - 0.6.9-1
changelog:
  - Update to 0.6.9
  - Use make_install macro
  - Mark COPYING and COPYING.LIB as %license
  - Tighten -devel subpackage deps


author: Josef Ridky <jridky@redhat.com> - 3.19.1-1
changelog:
  - Update to 3.19.1
  - Add patch to use libtirpc
  - Add BR gcc-c++
  - Resolves: #1580754 - FTBFS in RHEL-8


author: Filip Januš <fjanus@redhat.com> 5.3.28-42
changelog:
  - Apply the previous change only on aarch64 to limit the risk of unwanted impact
  - Resolves: #1992402


author: Sam Booth <sam.booth@oracle.com> - 5.3.28-42.0.1
changelog:
  - Update URL in rpm description [Orabug: 35986894]
  - Change http links in spec to https [Orabug: 35986894]
  - Buildrequire java-devel 1:1.8.0


author: Nicola Sella <nsella@redhat.com> - 0.55.0-1
changelog:
  - Add vendor to dnf API (RhBug:1876561)
  - Add formatting function for solver error
  - Add error types in ModulePackageContainer
  - Implement module enable for context part
  - Improve string formatting for translation
  - Remove redundant printf and change logging info to notice (RhBug:1827424)
  - Add allow_vendor_change option (RhBug:1788371) (RhBug:1788371)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-3
changelog:
  - Avoid multilib file conflict in config.h (RhBug:1918818)
  - [modules] Add special handling for src artifacts (RhBug:1809314)


author: Nicola Sella <nsella@redhat.com> - 0.55.0-4
changelog:
  - [context] improve retrieving repository configuration
  - Allow loading incomplete cache and loading ext solv files without its repodata


author: EL Errata <el-errata_ww@oracle.com> - 0.55.0-7.0.1
changelog:
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584] (Frank Deng)
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-8
changelog:
  - Substitute all repository config options (fixes substitution of baseurl)
  - Use solvfile userdata to store and check checksums and solv versions
  - Fix handling transaction id in resolveTransactionItemReason
  - Set short action for Reason Change


author: Lukas Hrazky <lhrazky@redhat.com> - 0.63.0-10
changelog:
  - Do not print errors on failovermethod repo option
  - the dnf_context_remove() function accepts `<package-spec>`, doc updates
  - advisory upgrade: filter out advPkgs with different arch


author: EL Errata <el-errata_ww@oracle.com> - 0.63.0-11.1.0.1
changelog:
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584] (Frank Deng)
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
  - Update OL8 dnf to recognise UEK7 as installonlypkgs package [Orabug: 33861658]


author: Jaroslav Rohel <jrohel@redhat.com> - 0.63.0-18
changelog:
  - filterAdvisory: match installed_solvables sort with lower_bound (RhBug:2212838, RHEL-1244)
  - Avoid reinstalling installonly packages marked for ERASE (RhBug:2163474, RHEL-1253)


author: EL Errata <el-errata_ww@oracle.com> - 0.63.0-19.0.1
changelog:
  - Recognise new kernel-uek RPMs as multiversion and installonlypkg [Orabug: 36053872]
  - Add support for apps that use libdnf to access yum url with 'ociregion' variable [Orabug: 30121584] (Frank Deng)
  - Update OL8 dnf to recognise kernel-uek as installonlypkgs package [Orabug: 31018668]
  - Disable rhsm [Orabug: 29901202]
  - Replaced bugzilla.redhat.com with bugzilla.oracle.com in config [Orabug: 29656932]
  - Update OL8 dnf to recognise UEK7 as installonlypkgs package [Orabug: 33861658]


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-1
changelog:
  - Update to 0.62.0
  - Hardening: add signature check with rpmcliVerifySignatures (RhBug:1932079)
  - Support allow_vendor_change setting in dnf context API
  - Add a new option module_obsoletes
  - Add new API applyObsoletes() function to apply modular obsoletes
  - Do not allow 1 as installonly_limit value (RhBug:1926261)
  - Add a config option to check TLS certificate revocation status (using OCSP stapling), defaults to false (RhBug:1814383)
  - Swdb: Add a method to get the current transaction
  - [context,API] Functions for accessing main/global configuration options
  - [context,API] Function for adding setopt
  - Add getter for modular obsoletes from ModuleMetadata
  - Add ModulePackage.getStaticContext() and getRequires()
  - Fix modular queries with the new solver
  - Fix: Fully set ssl in newHandle function
  - [conf] Add options for working with certificates used with proxy
  - Modify module NSVCA parsing - context definition (RhBug:1926771)
  - [context] Fix: dnf_package_is_installonly (RhBug:1928056)
  - Add getApplicablePackages to advisory and isApplicable to advisorymodule
  - Keep isAdvisoryApplicable to preserve API
  - [context] Support config file option "proxy_auth_method", defaults "any"
  - Support main config file options "installonlypkgs" and "protected_packages". Changes behaviour of microdnf and PackageKit.
  - Properly handle multiple collections in updateinfo.xml (RhBug:1804234)
  - Fix a crash when [media] section in .treeinfo is missing for bootable media (RhBug:1946024)
  - Add new dnf_context_module_install() C API


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.63.0-2
changelog:
  - Fix: dnf_context_module_install: memory leaks
  - covscan: remove unused vars, mark private func static, return values
  - DNF does not fail on non UTF-8 file names in a package


author: Lans Hung <lans.hung@oracle.com> - 0.63.0-3.0.2
changelog:
  - Update OL8 dnf to recognize UEK7(kernel-uek-core & kernel-uek-modules) as installonlypkgs package [Orabug: 33861658]


author: Filip Januš <fjanus@redhat.com> - 12.2-1
changelog:
  - Rebase onto: 12.2
  - update of patch(libecpg-10.5-external-libpq.patch) was needed
  - add upstream patch libecpg-12.2-dependency-build.patch
    https://www.postgresql.org/message-id/20200321221303.GA17979%40momjian.us


author: Honza Horak <hhorak@redhat.com> - 13.1-3
changelog:
  - Add Requires: libpgtypes to avoid the need to test interoperability
    between the various combinations of old and new subpackages


author: Jerry James <loganjerry@gmail.com> - 3.1-23.20170329cvs
changelog:
  - Add gcc BR
  - Build verbosely
  - Drop obsolete --enable-widec configure option
  - Fix "unused direct shared library dependency" warning from rpmlint again
  - Fix man page error due to BSD nroff macro that is not available on Linux
  - Drop explicit R on pkgconfig from the -devel package, autogenerated


author: Attila Lakatos <alakatos@redhat.com> - 0.1.10-3
changelog:
  - Rebuild due to the following message: libestr-0.1.10-2.el8 has already been built
    resolves: rhbz#2056293


author: Honggang Li <honli@redhat.com> - 1.11.1-1
changelog:
  - Rebase to upstream release v1.11.1
  - EFA Support requires libfabric
  - Resolves: bz1831145, bz1852636


author: Michal Schmidt <mschmidt@redhat.com> - 1.15.1-1
changelog:
  - Update to upstream release 1.15.1
  - Disable LTO on x86_64 due to memory issues (copied from Fedora)
  - Resolves: rhbz#2040450


author: Hans de Goede <hdegoede@redhat.com> - 1.1.2-3
changelog:
  - Pass --with-fontrootdir to ./configure so that libfontenc can find the
    encoding files (rhbz#1046341)


author: Brian C. Lane <bcl@redhat.com> - 0.26.5-1
changelog:
  - Rebase to 0.26.5 (CVE-2018-11235, CVE-2018-10887, CVE-2018-10888)
  - Disable SSH so that libssh2 is not required
  - Use python3 when building
  - Add README.rhel8 explaining why SSH is disabled


author: Brian C. Lane <bcl@redhat.com> - 0.26.8-1
changelog:
  - Update to 0.26.8
    Resolves: rhbz#1638880
  - Disable upstream online tests
    Related: rhbz#1638880
  - tests: Increase TOOBIG value used on i686
    Related: rhbz#1638880


author: Brian C. Lane <bcl@redhat.com> - 0.26.4-1
changelog:
  - Update to libgit2-glib-0.26.4
  - Switch to using meson build system
  - Disable SSH so that libssh2 is not required
  - Add README.rhel8 explaining why SSH is disabled


author: Kalev Lember <klember@redhat.com> - 3.21.92-1
changelog:
  - Update to 3.21.92
  - Don't set group tags
  - Use make_install macro
  - Use license macro for COPYING
  - Use desktop-file-validate instead of desktop-file-install
  - Tighten -devel deps with the _isa macro


author: Caolán McNamara <caolanm@redhat.com> 1.14.29-6
changelog:
  - Resolves: rhbz#1202683 thumbnails not created in absence of ImageMagick
    because gdk-pixbuf2-devel not present at build time


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.3-6
changelog:
  - Rebase to libguestfs 1.36 in RHEL 7.4.
    resolves: rhbz#1359086
  - v2v: always use names for libvirt pools
    resolves: rhbz#1141631
  - v2v: correctly find GRUB in RHEL UEFI guests
  - v2v: uninstall VMware tools packages from guests
    resolves: rhbz#1155150
  - v2v: install RHEV-APT only when using -o rhev/-o vdsm
    resolves: rhbz#1161019
  - New API: btrfs-filesystem-show
    resolves: rhbz#1164765
  - p2v: always enable debugging when running virt-v2v
    resolves: rhbz#1167623
  - libguestfs prefers virtio-pci on aarch64
    resolves: rhbz#1237250
  - v2v: make sure to copy all the driver files on Windows
    resolves: rhbz#1255610
  - Better tolerate corrupted Windows hivex; bump the hivex BuildRequires and
    Requires to >= 1.3.10-5.8.el7
    resolves: rhbz#1311890
  - v2v: ignore all the environment variables for proxy when exporting from
    vCenter
    resolves: rhbz#1354507
  - virt-sysprep can deal with full-LUKS encrypted guests
    resolves: rhbz#1362649
  - All the tools have bash completion scripts.
    resolves: rhbz#1367738
  - v2v: do not remove Processor and Intelppm nodes in Windows guests
    resolves: rhbz#1372668
  - Fix SELinux relabelling in old RHEL 6 guests, by adjusting a broken
    regular expression in file_contexts file
    resolves: rhbz#1374232
  - v2v: set all the properties on creation when exporting to Glance
    resolves: rhbz#1374405
  - v2v: set hw_video_model when exporting to Glance
    resolves: rhbz#1374651
  - v2v: fix OVA conversion as root using the libvirt backend
    resolves: rhbz#1375157
  - Various improvements and fixes to the documentation
    resolves: rhbz#1377081
    resolves: rhbz#1390876
    resolves: rhbz#1398070
    resolves: rhbz#1425306
  - v2v: support <listen type='socket'> and <listen type='none'>
    resolves: rhbz#1378022
  - v2v: allow libvirt >= 2.1.0 for vCenter conversions
    resolves: rhbz#1379240
  - p2v: enable mnemonics in the GUI
    resolves: rhbz#1379289
  - Split virt-p2v, and the tools for it, in an own package: virt-p2v-maker
    resolves: rhbz#1382275
  - Correctly parse mount options in btrfs entries in /etc/fstab.
    resolves: rhbz#1383517
  - Read secrets from libvirt domains, when inspecting them
    resolves: rhbz#1392798
  - v2v: add --vdsm-compat=1.1 flag for VDSM
    resolves: rhbz#1400205
  - Fix inspection with UsrMove and /usr in a separate partition
    resolves: rhbz#1401474
  - v2v: improve import compatibility with OVAs produced by AWS
    resolves: rhbz#1402301
  - resize: allow URIs for the output disk
    resolves: rhbz#1404182
  - Disable EDD when launching the appliance
    resolves: rhbz#1404287
  - v2v: increase the memory allocated to the appliance
    resolves: rhbz#1418283
  - p2v: switch from GTK+ 2 to GTK+ 3
  - p2v: add dbus-devel as BuildRequires to disable suspension during the
    conversion
  - libguestfs-java: bump the java-headless Require to >= 1.7.0, matching the
    Build-Require, and the generated bytecode
    resolves: rhbz#1364518
  - Do not try to use/write to /var/cache/yum & /var/log/yum.log
  - Bump ocaml-findlib-devel BuildRequires to >= 1.3.3-7.el7, because of
    RHBZ#1403897
  - v2v: remove --dcpath & --dcPath from --help output too
    resolves: rhbz#1429430
  - v2v: force VNC as display for -i disk, as SDL is not supported
    resolves: rhbz#1372671
  - v2v, p2v: rename rhvm network to ovirtmgmt
    resolves: rhbz#1429491
  - v2v: when exporting to local disk, check that UEFI firmware is installed
    before conversion
    resolves: rhbz#1429506
  - dib: actually generate SHA256 checksums when using --checksum
    resolves: rhbz#1430184
  - v2v: do not mention SUSE Xen hosts as supported
    resolves: rhbz#1430203
  - v2v: depend on OVMF/AAVMF, for converting EFI guests
    resolves: rhbz#1429643
  - v2v: use absolute path when using an OVA as backing file
    resolves: rhbz#1430680
  - v2v: support Debian/Ubuntu guests
    resolves: rhbz#1387213
  - sysprep: remove DHCP_HOSTNAME entries
    resolves: rhbz#1427529
  - v2v: avoid repeated "run virt-v2v -v -x" message on error
    resolves: rhbz#1167623
  - bash-completion: add script for virt-v2v-copy-to-local
    resolves: rhbz#1367738
  - v2v: fix virtio block driver installation for Windows 10 and Windows 2016
    resolves: rhbz#1434737
  - Replace the libosinfo dependency with osinfo-db, since we are only using
    the osinfo database.
  - v2v: fix virtio driver installation for Windows 8 UEFI
    resolves: rhbz#1431579
  - v2v: new 'vmx' import method
    resolves: rhbz#1441197
  - v2v: properly identify Windows 2016 guests when exporting them to RHV-M
    resolves: rhbz#1447202
  - Run pvresize in non-interactive mode
    resolves: rhbz#1460692
  - resize: make sure the input disk is read-only
    resolves: rhbz#1463714
  - Switch qemu-kvm-rhev dependency to qemu-kvm on aarch64
    resolves: rhbz#1463646


author: Pino Toscano <ptoscano@redhat.com> - 1:1.36.10-6
changelog:
  - Rebase to libguestfs 1.36.10 in RHEL 7.5.
    resolves: rhbz#1472272
  - Build against OCaml 4.05
    resolves: rhbz#1447981
  - Enable the copyonread flag when running the appliance using libvirt.
    resolves: rhbz#1466563
  - Make sure kernel-rt is never used as Requires.
    resolves: rhbz#1471651
  - v2v: disable unconfiguration of manually installed VMware tools.
    resolves: rhbz#1477905
  - v2v: prefer pigz or pxz for uncompressing OVA files, if available
    resolves: rhbz#1448739
  - resize: handle empty UUIDs for swap partitions
    resolves: rhbz#1482737
  - v2v: remove mention of --dcpath in an error message
    resolves: rhbz#1486197
  - Disables the QEMU image file locking when opening disks as read-only
    resolves: rhbz#1417306
    resolves: rhbz#1503497
  - Briefly document the format used for URIs
    resolves: rhbz#1450325
  - v2v: deal with grub2 configurations without a default set
    resolves: rhbz#1472288
  - v2v: warn when a guest has passthrough devices
    resolves: rhbz#1472719
  - v2v: fix three regular expressions
    resolves: rhbz#1494555
  - v2v: enable conversion of full-disk LUKS-encrypted Linux guests
    resolves: rhbz#1451665
  - v2v: new 'vddk' import method
    resolves: rhbz#1477912
    resolves: rhbz#1513884
  - Enable libguestfs to work on z Systems
    resolves: rhbz#1479526
  - p2v: fx check for sudo requiring a password
    resolves: rhbz#1500673
  - v2v: handle disks with snapshots in vCenter
    resolves: rhbz#1172425
  - rescue: backport improved version
    resolves: rhbz#1438710
  - v2v: improve bootloader detection
    resolves: rhbz#1508299
  - v2v: parse MAC address of network interfaces in OVF files
    resolves: rhbz#1506572
  - Unconditionally depend on libvirt-daemon-kvm >= 3.9.0-1, which will always
    pull the right qemu-kvm too, and thus remove the unversioned dependencies
    on it
    resolves: rhbz#1500870
  - v2v: fix RPM file owned test
    resolves: rhbz#1503958
  - Do not open read-only disks using <shareable/> in the libvirt backend
    resolves: rhbz#1518517
  - v2v: handle better when grubby does not report any default kernel
    resolves: rhbz#1519204
  - v2v: enhance vmx import method to access via SSH
    resolves: rhbz#1523767
  - builder: fix caching of templates when using --cache-all-templates
    resolves: rhbz#1523650


author: Jacob Wang <jacob.wang@oracle.com> - 1:1.38.4-10.0.1
changelog:
  - Config supermin to use host yum.conf in ol8 [Orabug: 29319324]
  - Set DISTRO_ORACLE_LINUX correspeonding to ol


author: John Mcwalters <john.mcwalters@oracle.com> - 1:1.38.4-11.1.0.1
changelog:
  - Config supermin to use host yum.conf in ol8 [Orabug: 29319324]
  - Set DISTRO_ORACLE_LINUX corresponding to ol


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.4-11
changelog:
  - Use a better icon for RHEL 7+ guests
    resolves: rhbz#1679483
  - Fix inspection of partition-less devices
    resolves: rhbz#1679966
  - v2v: ship a newer version of rhev-apt.exe
    resolves: rhbz#1688062


author: Pino Toscano <ptoscano@redhat.com> - 1:1.38.4-12
changelog:
  - v2v: update nbdkit information in documentation
    resolves: rhbz#1651115
  - v2v: use proper SELinux label for nbdkit sockets
    resolves: rhbz#1717088


author: Pino Toscano <ptoscano@redhat.com> - 1:1.40.2-23
changelog:
  - Ignore the user.WofCompressedData xattr
    resolves: rhbz#1811539
  - sysprep: new ipa-client and kerberos-hostkeytab operations
    resolves: rhbz#1789592


author: David Sloboda <david.x.sloboda@oracle.com> - 1:1.40.2-25.0.1
changelog:
  - Replace upstream references from description tag
  - Config supermin to use host yum.conf in ol8 [Orabug: 29319324]
  - Set DISTRO_ORACLE_LINUX correspeonding to ol


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-26
changelog:
  - insufficient default memsize to open anaconda default RHEL 8.2 luks device
    resolves: rhbz#1837765


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.40.2-27
changelog:
  - selinux-relabel does not work if SELINUXTYPE != targeted
  - tar-in command does not allow restoring file capabilities
    resolves: rhbz#1384241 rhbz#1828952


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.44.0-4
changelog:
  - Autodetect backing format for qemu-img create -b
  - Move appliance to separate subpackage
  - Read rpm database through librpm
    resolves: rhbz#2013916, rhbz#1989520, rhbz#1836094


author: Richard W.M. Jones <rjones@redhat.com> - 7.1-2
changelog:
  - New package for RHEL 7.1
  - Rebase to ntfs-3g 2014.2.15
    resolves: rhbz#1100319
  - Change the package so it works with supermin5.
  - Remove dependency on external FUSE.


author: Richard W.M. Jones <rjones@redhat.com> - 7.2-2
changelog:
  - Fix for handling guest filenames with invalid or incomplete
    multibyte or wide characters
    resolves: rhbz#1301593


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-1
changelog:
  - Rebase to 2017.3.23.
  - Remove patches which are now upstream.
  - Resynch with Fedora package.
  - Enable all architectures for RHEL 8.


author: Richard W.M. Jones <rjones@redhat.com> - 8.0-3
changelog:
  - Fix for CVE-2019-9755
    (heap-based buffer overflow leads to local root privilege escalation)
    resolves: rhbz#1698503


author: Richard W.M. Jones <rjones@redhat.com> - 8.6-1
changelog:
  - Rebase to ntfs-3g 2021.8.22
  - Fixes: CVE-2021-33285, CVE-2021-33286, CVE-2021-33287, CVE-2021-33289,
    CVE-2021-35266, CVE-2021-35267, CVE-2021-35268, CVE-2021-35269,
    CVE-2021-39251, CVE-2021-39252, CVE-2021-39253, CVE-2021-39254
    resolves: rhbz#2004490


author: Richard W.M. Jones <rjones@redhat.com> - 8.8-1
changelog:
  - Rebase to ntfs-3g 2022.5.17
  - Fixes: CVE-2021-46790, CVE-2022-30783, CVE-2022-30784, CVE-2022-30785,
    CVE-2022-30786, CVE-2022-30787, CVE-2022-30788, CVE-2022-30789
    resolves: rhbz#2127240 rhbz#2127248
    (also: 2127233 2127234 2127241 2127249 2127255 2127256 2127262 2127263)


author: Richard Hughes <richard@hughsie.com> 0.2.10-1
changelog:
  - New upstream version
  - Correctly detect removed devices when rescanning
  - Fix a memory leak when using control tranfers
  - Fix symbol version table up to version 0.2.9


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-4
changelog:
  - Ensure gxps_archive_read_entry() fills the GError in case of failure
  - Handle errors returned by archive_read_data()
  - Fixes CVE-2018-10733
  - Resolves: #1576113


author: Marek Kasik <mkasik@redhat.com> - 0.3.0-5
changelog:
  - Fix integer overflow in png decoder
  - Clear the error before trying to load an image again
  - Resolves: #1524378


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.34-1
changelog:
  - update to 1.34 (CVE-2017-14062)
  - include soname in file list
  - use macros for ldconfig
  - add gcc to build requirements


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.34-2
changelog:
  - fix ABI compatibility with libidn-1.33 and earlier (#1566414 #1573961)
  - add texinfo to build requirements


author: Bastien Nocera <bnocera@redhat.com> - 1.2.0-12
changelog:
  + libimobiledevice-1.2.0-12
  - Replace patches with a single mega-patch
  - Fixes usbmuxd for iOS 11 devices


author: Peter Hutterer <peter.hutterer@redhat.com> 1.11.903-2
changelog:
  - drop libinput replay, this tool requires libevdev-python which we don't
    have in RHEL and it's a debugging-tool only.


author: Peter Hutterer <peter.hutterer@redhat.com> 1.12.3-3
changelog:
  - Allow for the tablet mode quirk to apply to touchpads (#1664225)
  - Add a quirk for the Asus VivoBook Flip to keep the
    keyboard and touchpad working in tablet mode


author: Cole Robinson <crobinso@redhat.com> - 1.18.0-2
changelog:
  - Fix rdma deps and don't restrict archs
  - Add --disable-werror to fix gcc8 build (bz #1556044)
  - Spec file cleanups (bz #1483290)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-5.el8
changelog:
  - libiscsi-iser_rcv_completion-unify-error-handling.patch [bz#1634541]
  - libiscsi-iser-fix-posting-of-receive-descriptors.patch [bz#1634541]
  - libiscsi-sync-remove-unnecessary-checks.patch [bz#1634541]
  - libiscsi-do-not-warn-for-strncpy.patch [bz#1634541]
  - libiscsi-avoid-fallthrough.patch [bz#1634541]
  - libiscsi-avoid-truncation-when-logging-message-that-includes-.patch [bz#1634541]
  - Resolves: bz#1634541
    (Fix important coverity issues (libiscsi))


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> -
changelog:
  - libiscsi-fix-connection-to-LUN-with-IPv6-address.patch [bz#1597942]
  - Resolves: bz#1597942
    (Qemu-kvm fails to connect to iscsi LUN by IPV6 address)


author: Danilo Cesar Lemes de Paula <ddepaula@redhat.com> - 1.18.0-7.el8
changelog:
  - libiscsi-redhat-Remove-disable-werror-from-spec-file.patch [bz#1581025]
  - Resolves: bz#1581025
    (Remove --disable-werror from spec file)


author: Pavel Cahyna <pcahyna@redhat.com> - 1.4.8-4
changelog:
  - Remove KDE bits
  - Provide: mkisofs (as genisoimage does)
  - Increase alternative priority to win over genisoimage
  - Update RHEL conditionals for lib{isofs,burn} renaming to match those packages


author: Robert Scheck <robert@fedoraproject.org> 1.4.2-3
changelog:
  - Move large documentation into -doc subpackage (#744416)
  - Reworked spec file to build libisofs1 for RHEL >= 6 (#744416)


author: Akira TAGOH <tagoh@redhat.com> - 0.6.2-8
changelog:
  - Suppress documentation in Flatpak builds
    Resolves: rhbz#1896257
  - build gir with non-parallel to avoid strange behavior.


author: Isaac Boukris <iboukris@redhat.com> - 2.2.0-1
changelog:
  - Resolves: rhbz#1878114 - Rebase libldb to the version required by Samba
  - Resolves: rhbz#1794349 - Build libldb with lmdb support


author: Andreas Schneider <asn@redhat.com> - 2.3.0-1
changelog:
  - resolves: rhbz#1945021 - Update to version 2.3.0
  - resolves: rhbz#1897082 - Fix libldb tests on aarch64


author: Nicolas Chauvet <kwizart@gmail.com> - 0.15.1b-15
changelog:
  - Don't use multiarch patch when the result is not hardcoded
  - Update FPM
  - Add patches from lp#534287 and lp#534287


author: Jan Vcelak <jvcelak@fedoraproject.org> 1.1.1-4
changelog:
  - remove utils subpackage and place mmdblookup into devel subpackage
  - remove Group from the spec file
  - move NOTICE and Changes.md to devel subpackage


author: Michal Ruprich <mruprich@redhat.com> - 1.2.0-6
changelog:
  - Adding libmaxminddb as a new package to RHEL-8 (rhbz#1607927)
  - Adding Recommends tag for geolite2 databases


author: Martin Gansser <martinkg@fedoraproject.org> - 1:0.9.57-1
changelog:
  - Update to 0.9.57
  - Dropped dependency on libgcrypt
  - Dropped dependency on openssl
  - Update tarball link to "https:"
  - Add examples from doc/examples


author: Stephen Gallagher <sgallagh@redhat.com> - 1.6.2-1
changelog:
  - Update to 1.6.2
  - Make buildorder a signed integer to match modulemd specification
  - Obsolete unsupported pythonX-modulemd packages


author: Stephen Gallagher <sgallagh@redhat.com> - 2.0.0-0.beta2
changelog:
  - Update to 2.0.0beta2
  - Better validation of stored content during read and write operations
  - ModuleIndex now returns FALSE if any subdocument fails
  - Fix tests on 32-bit platforms
  - Make unknown keys in YAML maps non-fatal for libmodulemd1
  - Make unknown keys in YAML maps optionally fatal for libmodulemd 2.x
  - Fix RPM version requirements for libmodulemd1


author: Stephen Gallagher <sgallagh@redhat.com> - 2.0.0-1
changelog:
  - Update to 2.0.0 final
  - Assorted fixes for validation
  - Add modulemd-validator tool based on v2 code
  - Fix a crash when merging defaults
  - Add missing BuildRequires


author: Stephen Gallagher <sgallagh@redhat.com> - 2.5.0-2
changelog:
  - Fix memory corruption error using Module.search_rpms() from python
  - Speed up valgrind tests
  - Resolves: rhbz#1714766


author: Karel Zak <kzak@redhat.com> 2.32.1-10
changelog:
  - fix #1699310 - rpm -V setup fail on /var/log/lastlog
  - fix #1702712 - pam_env bypassed for root user when using su


author: Karel Zak <kzak@redhat.com> 2.32.1-13
changelog:
  - fix #1734553 - blkid_get_dev() leak file descriptor to underlying block device
  - fix #1719069 - findmnt warning "recommended root FS passno is 1" for XFS


author: Karel Zak <kzak@redhat.com> 2.32.1-18
changelog:
  - fix #1739443 - lscpu reports wrong hypervisor in nested virt on s390x
  - fix #1743555 - command chfn adds some useless commas with GECOS information into /etc/password


author: Karel Zak <kzak@redhat.com> 2.32.1-23
changelog:
  - fix #1826251 - remove MD metadata 0.90 based tests from util-linux CI
  - fix #1812576 - RFE: Bitlocker detection for RHEL 8.3
  - fix #1817726 - add libblkid BLOCK_SIZE
  - fix #1803753 - RHEL-8: col struct char_str c_column field should be of unsigned type and/or larger than 16 bit
  - fix #1812118 - mount -a always tries to mount smb3 share subdir despite being already mounted
  - fix #1824727 - util-linux: Include python3-libmount package in the release
  - fix #1829245 - mount -a tries to mount already mounted cifs shares when we cannot query up to root dir


author: Karel Zak <kzak@redhat.com> 2.32.1-25
changelog:
  - fix #1884194 - RHEL-8: chrt command does not support the -R option
  - fix #1855759 - mount.8: clarify (no)suid behavior on file capabilities
  - fix #1861670 - lsblk can not show serial information for virtio disk
  - fix #1883783 - lscpu: avoid segfault on PowerPC systems with valid hardware configurations
  - fix #1900498 - libfdisk/libmount: backport two patches for upstream systemd
  - fix #1883056 - lscpu support for Fujitsu A64FX
  - fix #1882740 - lscpu: use SMBIOS Type 4 strings for CPU vendor and model on ARM


author: Karel Zak <kzak@redhat.com> 2.32.1-28
changelog:
  - fix #1906157 - after su from root to a normal user mesg is unable to show current status
  - fix #1917852 - findmnt: add option to list all fs-independent flags
  - fix #1922299 - throws error using /sbin/nologin: invalid option -- 'c'
  - fix #1940607 - lsblk sometimes returns block devices in wrong order with --pairs
  - fix #1919529 - [RFE] RHEL-8: Support option flags with mount(8) --bind
  - fix #1946921 - RHEL8: mount --rbind -o rprivate doesn't do recursive bind mount


author: Karel Zak <kzak@redhat.com> 2.32.1-29
changelog:
  - fix #1988955 - script command continues without stopping.
  - fix #2041498 - incorrect partition size calculation for BLKPG_* ioctls
  - fix #2011602 - logger from util-linux incorrectly handles long messages
  - fix #1916151 - [RFE] spread fstrim.timer across time
  - fix #1894192 - Update or backport setpriv --pdeathsig
  - fix #2026511 - blkid fails to complete when targeting  non-block devices


author: Karel Zak <kzak@redhat.com> 2.32.1-31
changelog:
  - improve #2026511 fix - blkid fails to complete when targeting non-block devices
  - fix #1950187 - Ambient capabilities failed to applied to non-root user


author: Karel Zak <kzak@redhat.com> 2.32.1-36
changelog:
  - fix #2060030 - Please backport patches for atari partition detection to RHEL 8
  - fix #2069187 - Internal testsuite for lscpu failed on aarch64
  - fix #2093166 - lslogins reports incorrect "Password is locked" status
  - fix #2059241 - rpm -V / --verify reports bad user/group/mtime for /run/uuidd
  - fix #2044592 - Move /var/log/lastlog ownership to systemd


author: Karel Zak <kzak@redhat.com> 2.32.1-40
changelog:
  - fix #2121699 - fstrim -av fails to trim root filesystem on Red Hat Coreos 
  - fix #2142496 - update upstream tests
  - fix #2149394 - umount outputs inaccurate error message when umount() fails with EACCES
  - fix #2159544 - lslogins "Password is locked" status changed in util-linux-2.32.1-38
  - fix #2160321 - [last] ut->ut_user is not null terminated


author: Karel Zak <kzak@redhat.com> 2.32.1-43
changelog:
  - fix #2117355 - Add additional documentation for fstab
  - fix #2184728 - libuuid - downport cache related patch
  - fix #2188894 - The swapon man page of -p(priority) option shows incorrect.
  - fix #2227097 - wall(1) fail when trying to use seat0


author: Karel Zak <kzak@redhat.com> 2.32.1-46
changelog:
  - fix RHEL-13741 - lscpu: avoid EBUSY on cpuinfo_max_freq
  - fix RHEL-18451 - logger: initialize socket credentials control union
  - fix RHEL-16070 - util-linux: issues in libblkid
  - fix RHEL-6274 - lslogins incorrect account expiration field


author: Karel Zak <kzak@redhat.com> 2.32.1-48
changelog:
  - fix RHEL-134296 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-133946 - login-utils: fix setpwnam() buffer use [CVE-2025-14104]


author: Karel Zak <kzak@redhat.com> - 2.32-3
changelog:
  - sync spec file with Fedora
  - move /etc/adjtime config from initscripts to util-linux
  - fix #1560642 - uuidd.service does not start
  - remove unused build option --enable-libmount-force-mountinfo (it's default now)
  - disable assert code


author: Karel Zak <kzak@redhat.com> 2.32.1-4
changelog:
  - fix #1614364 - losetup: /dev/loop1: failed to set up loop device
  - fix #1614852 - mount man page says sync option has no effect for ext4
  - fix #1614843 - Man page of logger is missing -S option


author: Karel Zak <kzak@redhat.com> 2.32.1-7
changelog:
  - fix #1656437 - Failing tests from testsuite
  - fix #1653781 - unable to umount by loop backing file
  - fix #1655650 - RHEL8.0 - fdisk -l shows the conflicting partitions name for the mpath
  - fix #1653413 - blkid: add --no-part-details to not return metadata from empty partitions


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.1.alpha
changelog:
  - New upstream version 0.7alpha.
  - No tarball was uploaded so temporarily use tarball from github.
  - Fixes CVE-2018-14679 libmspack: off-by-one error in the CHM PMGI/PMGL
    chunk number validity checks


author: Richard W.M. Jones <rjones@redhat.com> - 0.7-0.2.alpha.4
changelog:
  - Fix for CVE-2019-1010305
  - Remove "fix" for CVE-2018-14680 as this fix is included in base tar ball.
    resolves: rhbz#1736745, rhbz#1736743


author: Dominik Mierzejewski <dominik@greysector.net> - 1.1.13-2
changelog:
  - Use https source URL
  - Drop obsolete spec elements
  - Use license macro
  - Update libusbx-devel build dependency
  - Drop ancient (F15) Obsoletes:
  - Tighten file list


author: David King <amigadave@amigadave.com> 5.1.0-1
changelog:
  - Update to 5.1.0 (#1164434)
  - Drop libxml2 patch (fixed upstream)
  - Use pkgconfig for BuildRequires


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.2-1
changelog:
  - New upstream version 1.0.2.
  - Remove patches which are upstream.
  - Contains fix for NBD Protocol Downgrade Attack (CVE-2019-14842).
  - Fix previous commit message.


author: Richard W.M. Jones <rjones@redhat.com> - 1.0.3-1
changelog:
  - New upstream version 1.0.3.
  - Contains fix for remote code execution vulnerability.
  - Add new libnbd-security(3) man page.


author: Robert Scheck <robert@fedoraproject.org> 1.1.6-7
changelog:
  - Run autoreconf to recognize aarch64 (#925813)
  - Conditionalized usage of %{_lib} vs %{_libdir} for RHEL < 7
  - Tight run-time dependencies between sub-packages via %{?_isa}


author: Andreas Schneider <asn@redhat.com> - 4.17.2-1
changelog:
  - resolves: rhbz#2132051 - Update to version 4.17.2
  - resolves: rhbz#2126174 - Fix CVE-2022-1615
  - resolves: rhbz#2108487 - ctdb: Add dependency to samba-winbind-clients


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.2-2
changelog:
  - Always add epoch to samba_depver to fix osci.brew-build.rpmdeplint.functional
  - related: rhbz#2132051


author: Pavel Filipenský <pfilipenn@redhat.com> - 4.17.4-0
changelog:
  - related: rhbz#2132051 - Update to version 4.17.4
  - resolves: rhbz#2154370 - Fix CVE-2022-38023
  - resolves: rhbz#2142331 - Fix %U include directive for share listing (netshareenum)
  - resolves: rhbz#2148943 - Fix Winbind to retrieve user groups from Active Directory


author: Pavel Filipenský <pfilipen@redhat.com> - 4.17.5-2
changelog:
  - resolves: rhbz#2169339 - Fix winbind memory leak
  - resolves: rhbz#2152899 - Fix Samba shares not accessible issue


author: EL Errata <el-errata_ww@oracle.com> - 4.17.5-2.0.1
changelog:
  - Fix memleak in _nss_winbind_initgroups_dyn [Orabug: 34727815]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Darren Archibald <darren.archibald@oracle.com> - 4.17.5-3
changelog:
  - resolves: rhbz#2223601 - Fix trust relationship between workstation and DC
  - resolves: rhbz#2222895 - Fix CVE-2023-3347


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.4-1
changelog:
  - resolves: rhbz#2221594 - Fix broken symlink for libwbclient
  - resolves: rhbz#2221600 - Fix segfault of winbind child when listing users with `winbind scan trusted domains = yes`
  - resolves: rhbz#2175385 - Fix access of Samba share with veto files = /.*/
  - resolves: rhbz#2218237 - Fix Python tarfile extraction to avoid a warning


author: Pavel Filipenský <pfilipen@redhat.com> - 4.18.5-0
changelog:
  - resolves: rhbz#2222894 - Fix CVE-2022-2127 CVE-2023-3347 CVE-2023-34966 CVE-2023-34967 CVE-2023-34968


author: Andreas Schneider <asn@redhat.com> - 4.18.6-1
changelog:
  - related: rhbz#2190417 - Update to version 4.18.6
  - resolves: rhbz#2232564 - Fix the rpc dsgetinfo command


author: Srinivas Maturi <srinivas.maturi@oracle.com> - 4.18.6-1.0.1
changelog:
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Mark Will <mark.will@oracle.com> - 4.18.6-2.0.1
changelog:
  - resolves: RHEL-11937
    Fix CVE-2023-3961 - smbd must check the pipename
  - resolves: RHEL-11937
    Fix CVE-2023-4091 - SMB clients can truncate files
  - resolves: RHEL-11937
    Fix CVE-2023-42669 - Remove rpcecho server


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-10
changelog:
  - resolves: RHEL-101902 - Fix DC discovery after Windows netlogon hardening - follow-up
  - resolves: RHEL-111318 - Fix winbind fork bomb in 'IPA with AD trust' environment


author: EL Errata <el-errata_ww@oracle.com> - 4.19.4-10.0.1
changelog:
  - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285]
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs in OL8 [Orabug: 30205755]


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.3-1
changelog:
  - resolves: RHEL-16483 - Update to version 4.19.3
  - resolves: RHEL-11361
              - Fix CVE-2023-3961 CVE-2023-4091 CVE-2023-42669
  - resolves: RHEL-2228  - Logging Format Enhancement
  - resolves: RHEL-1965  - Fix smbget issues with DFS shares
  - resolves: RHEL-2108  - Fix force user/group issues with 'allow trusted domains = yes'
  - resolves: RHEL-17122 - Fix memory corruption in libnss_winbind


author: Pavel Filipenský <pfilipen@redhat.com> - 4.19.4-2
changelog:
  - Fix error in PREIN scriptlet in rpm package samba-common
  - related: RHEL-16483 - Update to version 4.19.4


author: Darren Archibald <darren.archibald@oracle.com> - 4.19.4-3.0.1
changelog:
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Akshata Konala <akshata.konala@oracle.com> - 4.19.4-4.0.1
changelog:
  - s3: winbindd: winbindd_pam: fix leak in extract_pac_vrfy_sigs [Orabug: 36518285]
  - s3:passdb: Do not leak memory in pdb_tdb [Orabug: 36371377]
  - Gluster volumes not accessible via Samba due to missing samba-vfs-glusterfs
    in OL8 [Orabug: 30205755]


author: Steve Dickson <steved@redhat.com> 2.3.3-6
changelog:
  - Changed /var/lib/nfs/rpc_pipefs to have 555 permissions (bz 1583489)
  - Removed tcp wrappers support from man pages (bz 1642596) 
  - Reload not restart gssproxy in nfs-server.service (bz 1592660)


author: Steve Dickson <steved@redhat.com> 2.3.3-8
changelog:
  - Update junction code with latest upstream code (1543126)
  - Make sure /etc/sysconfig/nfs is immutabl (1639432)


author: Steve Dickson <steved@redhat.com> 2.3.3-12
changelog:
  - Change nfsconvert.sh not to set the immutable bit (bz 1673685)
  - Change nfsconvert.py not to create the new dummy /etc/sysconfig/nfs (bz 1673685)


author: Steve Dickson <steved@redhat.com> 2.3.3-14_0
changelog:
  - Add nfs.conf equivalent for the statd --no-notify cmdline option (1690280)
  - Correct the modes on /etc/nfs.conf after a conversion (bz 1690266)


author: Steve Dickson <steved@redhat.com> 2.3.3-17
changelog:
  - Moved the gating tests out of a patch and into the top dir (bz 1653927)
  - Move the mode corrections on /etc/nfs.conf to nfsconvert.py (bz 1655880)
  - gssd: add verbosity options to the rpc.gssd man page (bz 1668026)


author: Steve Dickson <steved@redhat.com> 2.3.3-24
changelog:
  - nfs.man: Fixed small typo in man page (bz 1732877)
  - mount: Report correct error in the fall_back cases (bz 1709963)
  - rpc.mountd: Fix e_hostname and e_uuid leaks (bz 1712202)
  - spec: Remove redundant manpage files (bz 1718738)


author: Steve Dickson <steved@redhat.com> 2.3.3-27
changelog:
  - More coverity scans updates (bz 1746572)
  - nfsd: Adjust nfs.conf setting/parsing of rdma port (bz 1710532)
  - Add plain --rdma option to nfs.conf convertor (bz 1747295)
  - mountstats: Add per-op error counts to iostat command (bz 1719983)
  - gssd: add configure options verbosity to man page (bz 1749642)


author: Steve Dickson <steved@redhat.com> 2.3.3-32
changelog:
  - junction: Fixed debug statement (bz 1831829)
  - Userspace support for the latest nfsdcld daemon (bz 1817756)


author: Steve Dickson <steved@redhat.com> 2.3.3-33
changelog:
  - manpage: Add a description of the 'nconnect' mount option (bz 1761352)
  - nfsdclddb: Redname clddb-tool to nfsdclddb (bz 1836924)


author: Steve Dickson <steved@redhat.com> 2.3.3-38
changelog:
  - exports man page: warn about subdirectory exports (bz 1652437)
  - Don't modify /etc/group on upgrades (bz 1856881)
  - nfs-iostat: divide by zero with fresh mount (bz 1861823)
  - nfsiostat: Drop autofs entries before calling compare_iostats() (bz 1859130)
  - nfsdclddb: clddb-tool was recently renamed to nfsdclddb (bz 1893599)


author: Steve Dickson <steved@redhat.com> 2.3.3-39
changelog:
  - systemd: Ingnore export failures in nfs-server.serivce unit (bz 1894873)
  - exports.man: Remove some outdated verbiage (bz 1769688)


author: Steve Dickson <steved@redhat.com> 2.3.3-42
changelog:
  - gssd: Add options to allow for the use of ~/.k5identity file (bz 1868087)
  - man: Correct gssd(8) description of rpc-timeout and context-timeout (bz 1908232)
  - exportfs: fix unexporting of '/' (bz 1944119)


author: Steve Dickson <steved@redhat.com> 2.3.3-44
changelog:
  - gssd: Deal with failed thread creation (bz 1981400)
  - gssd: Add timeout for upcall threads (bz 1981403)
  - gssd: Cleaned up debug messages (bz 1961056)
  - spec: Updated description of the nfs-utils rpm (bz 1981419)


author: Steve Dickson <steved@redhat.com> 2.3.3-59
changelog:
  - Covscan Scan: Wrong Check of Return Value (bz 2151966)
  - Covscan Scan: Clang (experimental) (bz 2151971)


author: Scott Mayhew <smayhew@redhat.com> 2.3.3-61
changelog:
  - gssd: unconditionally use krb5_get_init_creds_opt_alloc (RHEL-62422)
  - gssd: do not use krb5_cc_initialize (RHEL-62422)


author: EL Errata <el-errata_ww@oracle.com> - 2.3.3-64.0.1
changelog:
  - nfsd: allow more than 64 backlogged connections
  - spec: remove multiple warnings when upgrading nfs-utils with gssproxy [Orabug: 35173372]


author: Scott Mayhew <smayhew@redhat.com> 2.3.3-67
changelog:
  - mountd: Minor refactor of get_rootfh() (RHEL-127095)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127095)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127095)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127095)
    Resolves: CVE-2025-12801


author: Phil Sutter <psutter@redhat.com> [1.1.1-2.el8]
changelog:
  - chain: Hash chain list by name (Phil Sutter) [1658533]
  - chain: Add lookup functions for chain list and rules in chain (Phil Sutter) [1658533]
  - chain: Support per chain rules list (Phil Sutter) [1658533]
  - src: remove nftnl_rule_cmp() and nftnl_expr_cmp() (Phil Sutter) [1658533]


author: Phil Sutter <psutter@redhat.com> [1.1.1-3.el8]
changelog:
  - src: chain: Fix nftnl_chain_rule_insert_at() (Phil Sutter) [1666495]
  - src: chain: Add missing nftnl_chain_rule_del() (Phil Sutter) [1666495]
  - flowtable: Fix for reading garbage (Phil Sutter) [1661327]
  - flowtable: Fix memleak in nftnl_flowtable_parse_devs() (Phil Sutter) [1661327]
  - flowtable: Fix use after free in two spots (Phil Sutter) [1661327]
  - flowtable: Add missing break (Phil Sutter) [1661327]
  - object: Avoid obj_ops array overrun (Phil Sutter) [1661327]


author: Phil Sutter <psutter@redhat.com> [1.1.4-2.el8]
changelog:
  - obj/ct_timeout: Fix NFTA_CT_TIMEOUT_DATA parser (Phil Sutter) [1758673]
  - set_elem: Validate nftnl_set_elem_set() parameters (Phil Sutter) [1758673]
  - obj/ct_timeout: Avoid array overrun in timeout_parse_attr_data() (Phil Sutter) [1758673]
  - set: Don't bypass checks in nftnl_set_set_u{32,64}() (Phil Sutter) [1758673]
  - obj/tunnel: Fix for undefined behaviour (Phil Sutter) [1758673]
  - set_elem: Fix return code of nftnl_set_elem_set() (Phil Sutter) [1758673]
  - obj: ct_timeout: Check return code of mnl_attr_parse_nested() (Phil Sutter) [1758673]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el8]
changelog:
  - chain: Correctly check realloc() call (Phil Sutter) [1778952]
  - flowtable: Correctly check realloc() call (Phil Sutter) [1778952]
  - chain: Fix memleak in error path of nftnl_chain_parse_devs() (Phil Sutter) [1778952]
  - flowtable: Fix memleak in error path of nftnl_flowtable_parse_devs() (Phil Sutter) [1778952]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el8]
changelog:
  - set_elem: Introduce support for NFTNL_SET_ELEM_KEY_END (Phil Sutter) [1795223]
  - set: Add support for NFTA_SET_DESC_CONCAT attributes (Phil Sutter) [1795223]
  - include: resync nf_tables.h cache copy (Phil Sutter) [1795223]


author: Phil Sutter <psutter@redhat.com> [1.1.5-5.el8]
changelog:
  - set: expose nftnl_set_elem_nlmsg_build() (Phil Sutter) [2040754]
  - expr: dynset: release stateful expression from .free path (Phil Sutter) [2040478]
  - set_elem: missing set and build for NFTNL_SET_ELEM_EXPR (Phil Sutter) [2040478]


author: Tomas Hoger <thoger@redhat.com> - 0.1.13-11
changelog:
  - Add conditional for building with(out) gst010 / GStreamer 0.10 support.
  - Disable gst010 plugin by default.


author: Stefan Becker <chemobejk@gmail.com> - 0.1.14-3
changelog:
  - update to 0.1.14-70-gfb2f1f7 with alternate server fixes for SIPE
  - add autoreconf build step
  - remove examples subpackage as examples are no longer installed


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-4.20171128gitfb2f1f7
changelog:
  - enable make check again
  - make tests pass in Koji
  - disable test-new-dribble that sometimes hangs indefinitely
  - make tests compile on i686
  - make the package build on armv7hl
  - make the package build on Fedora 28
  - avoid build failure if gstreamer-plugins-base-devel is installed
  - move autoreconf invocation to %prep
  - use Name Version Release that explicitly identifies an SCM snapshot (#1541646)


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-6.20171128gitfb2f1f7
changelog:
  - temporarily make the upstream test-suite run on Intel arches only
  - disable test-send-recv, which fails in Koji


author: Kamil Dudka <kdudka@redhat.com> - 0.1.14-7.20180504git34d6044
changelog:
  - component: accept TURN in nice_component_verify_remote_candidate() (#1541646)
  - update to 0.1.14-85-g34d6044 (#1541646)


author: Lubomir Rintel <lkundrak@v3.sk> - 1.8.26-2
changelog:
  - Fixes suggested in review by Matthew Krupcale (#1763285):
  - Add gcc BR
  - Fixed the libnma-gtk4 conditional
  - Made dependencies arch-specific where relevant
  - Dropped obsolete macros
  - Install license file with libnma-gtk4


author: Thomas Haller <thaller@redhat.com> - 1.8.28-1
changelog:
  - Update to 1.8.28 release
  - move org.gnome.nm-applet.gschema.xml from network-manager-applet to here.
  - introduce wireless security dialogs


author: Ana Cabral <acabral@redhat.com> - 1.8.36-1
changelog:
  - Update to 1.8.36 release (rh #2062686)
  - Include OWE wireless security (rh #2060327)
  - Fix OWE wireless security entry in Hidden Networks dialog (rh #2057514)


author: Thomas Haller <thaller@redhat.com> - 1.8.10-2
changelog:
  - fix double-free handling VPN data in nm-applet (rh #1541565)
  - fix certificate chooser for no available modules (bgo #785674)


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.1.24-19
changelog:
  - remove old stuff https://lists.fedoraproject.org/archives/list/devel@lists.fedoraproject.org/thread/MRWOMRZ6KPCV25EFHJ2O67BCCP3L4Y6N/


author: Michal Ruprich <michalruprich@gmail.com> - 14:1.9.1-1
changelog:
  - Resolves: #1806422 - rebase libpcap to version 1.9.1
  - Resolves: #1743650 - [RFE] enable inbox support for sniffing offloaded (RDMA) traffic with tcpdump
  - Resolves: #1785330 - Invalid IPv4 addresses are accepted without reporting even a warning
  - Resolves: #1792208 - Resource exhaustion while PHB header length validation


author: Bastien Nocera <bnocera@redhat.com> - 1.22.0-6
changelog:
  + libpeas-1.22.0-6
  - Remove python2 loader, all GNOME apps using libpeas were ported to Python3
    when ported to GTK+ 3.x, and obsolete libpeas-loader-python
  - Resolves: #1559090


author: Kalev Lember <klember@redhat.com> - 1.12-9
changelog:
  - Remove lib64 rpaths
  - Disable strict aliasing as it's not strict-aliasing clean on ppc64el
  - Don't redefine licensedir


author: Peter Robinson <pbrobinson@fedoraproject.org> 2.0.0-1
changelog:
  - Update to upstream 2.0.0
  - Fixes the following CVEs plus others
  - CVE-2017-6440 CVE-2017-6439 CVE-2017-6438 CVE-2017-6437 CVE-2017-6436
  - CVE-2017-6435 CVE-2017-5836 CVE-2017-5835 CVE-2017-5834 CVE-2017-5545
  - CVE-2017-5209


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 2.0.0-4
changelog:
  - Python 2 binary package renamed to python2-libplist
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Bastien Nocera <bnocera@redhat.com> - 2.0.0-10
changelog:
  + libplist-2.0.0-10
  - The Python3 Cython binary is now called "cython" not "cython3"
  - Resolves: #1611726


author: Dan Winship <danw@redhat.com> - 0.4.15-5.1
changelog:
  - Drop python2 subpackage (#1559092)
  - Drop PAC runner based on the "pacrunner" package (#1569023)
  - Replace pacrunner-crash-fix patch with version from RHEL7
  - Drop kde subpackage (#1538147)


author: Tomáš Mráz <tmraz@redhat.com> 1.4.0-1
changelog:
  - Do not try to check presence of too short username in password
  - Make the user name check optional (via usercheck option)
  - Add an 'enforcing' option to make the checks to be warning-only
    in PAM
  - The difok = 0 setting will disable all old password similarity
    checks except new and old passwords being identical
  - Updated translations from Zanata


author: Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl> - 1.4.0-4
changelog:
  - Python 2 binary package renamed to python2-pwquality
    See https://fedoraproject.org/wiki/FinalizingFedoraSwitchtoPython3


author: Tomáš Mráz <tmraz@redhat.com> 1.4.4-1
changelog:
  - Translation updates
  - Add usersubstr check for substrings of N characters from the username
    patch by Danny Sauer
  - pam_pwquality: Abort the retry loop if user requests it
  - Allow setting retry, enforce_for_root, and local_users_only options
    in the pwquality.conf config file


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1.4.4-3
changelog:
  - Resolves: rhbz#1919026 libpwquaily rpm requires cracklib to function but RPM missing requirement [updated]


author: Nils Philippsen <nils@tiptoe.de> - 2.1.2-1
changelog:
  - version 2.1.2
  - tidy up spec file
  - use %license for license file
  - require same arch main from devel package


author: Attila Lakatos <alakatos@redhat.com> - 1.6.1-1
changelog:
  - Rebase to 1.6.1
    resolves: RHEL-12892
  - Fix warnings reported by rpmlint
  - Enable support for zlib/zstd compression and GSSAPI


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-6
changelog:
  - Resolves: rhbz#1980800 allow convert to csv to write each sheet to
    separate file
  - Resolves: rhbz#1992695 two style tags where there should be one


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-7
changelog:
  - Resolves: rhbz#2013858 CVE-2021-25633
  - Resolves: rhbz#2014215 CVE-2021-25634
  - Resolves: rhbz#2014209 CVE-2021-25635


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-9
changelog:
  - Related: rhbz#2029810 set NoDisplay=true for .desktop on s390x/aarch64
  - Related: rhbz#2029810 don't Require any vclplug for s390x/aarch64


author: EL Errata <el-errata_ww@oracle.com> - 1:6.4.7.2-10.0.1
changelog:
  - Replace colors with Oracle colors [Orabug: 32120093]
  - Build with --with-vendor="Oracle America, Inc."
  - Added the --with-hamcrest option to configure.


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-12
changelog:
  - Resolves: rhbz#2134752 CVE-2022-26305 Untrusted Macros
  - Resolves: rhbz#2134751 CVE-2022-26307 Weak Master Keys
  - Resolves: rhbz#2134750 CVE-2022-26306 Static Initialization Vector
  - Resolves: rhbz#2134753 CVE-2022-3140 Macro URL arbitrary script execution


author: Caolán McNamara <caolanm@redhat.com> - 1:6.4.7.2-12
changelog:
  - Resolves: rhbz#2118928 CVE-2022-26305 Untrusted Macros
  - Resolves: rhbz#2118924 CVE-2022-26307 Weak Master Keys
  - Resolves: rhbz#2118920 CVE-2022-26306 Static Initialization Vector
  - Resolves: rhbz#2134702 CVE-2022-3140 Macro URL arbitrary script execution


author: Stephan Bergmann <sbergman@redhat.com> - 1:6.4.7.2-15
changelog:
  - Resolves: rhbz#2210191 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210195 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208509 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Ales Matej <amatej@redhat.com> - 1.10.6-1
changelog:
  - Update to 1.10.6
  - Imporove handling of xattr to re-download damadged files (RhBug:1690894)
  - Rephrase repository GPG check error message (RhBug:1741442)
  - Add sleep before next try when all mirrors were tried (RhBug:1741931)
  - Raise logging level of error messages (RhBug:1737709)
  - Handle webservers that don't support ranges when downloading zck
  - Define LRO_SUPPORTS_CACHEDIR only with zchunk (RhBug:1726141)
  - Allow to use mirrors multiple times for a target (RhBug:1678588)
  - Allow to try baseurl multiple times (RhBug:1678588)


author: Ales Matej <amatej@redhat.com> - 1.11.0-1
changelog:
  - Update to 1.11.0
   - Retry mirrorlist/metalink downloads several times (RhBug:1741931)
   - Improve variable substitutions in URLs and add ${variable} support


author: Ales Matej <amatej@redhat.com> - 1.11.3-1
changelog:
  - Update to 1.11.3
   - Prefer mirrorlist/metalink over baseurl (RhBug:1775184)
   - Fix calling Python API without holding GIL (RhBug:1788918) 
   - Do not unref LrErr_Exception on exit (RhBug:1778854)


author: Nicola Sella <nsella@redhat.com> - 1.12.0-1
changelog:
  - Update to 1.12.0
  - Decode package URL when using for local filename (RhBug:1817130)
  - Fix memory leak in lr_download_metadata() and lr_yum_download_remote()
  - Download sources work when at least one of specified is working (RhBug:1775184)
  - Enable building on OSX


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.0-1
changelog:
  - Update to 1.14.0
  - Fix the key string parsing in url_substitution
  - When zchunk enabled and not using HTTP/S protocol, download the whole file (RhBug:1886706)
  - Add an option LRO_SSLVERIFYSTATUS to check TLS certificate revocation status (using OCSP stapling) (RhBug:1814383)
  - Fix: lr_perform() - Avoid 100% CPU usage
  - Add support for working with certificates used with proxy
  - Reposync does not re-download unchanged packages (RhBug:1931904)
  - Fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 1.14.2-1
changelog:
  - Update to 1.14.2
  - Reduce time to load metadata
  - Fix resource leaks and memory leaks
  - Remove build dependency on python3-flask


author: Lukas Hrazky <lhrazky@redhat.com> - 1.14.2-4
changelog:
  - Fix termination of va_list in lr_metadatatarget_append_error()
  - Detailed error message when using non-existing TMPDIR


author: Sergio Durigan Junior <sergiodj@redhat.com> - 0.0.4-12
changelog:
  - Resolves: rhbz#1786466 Do not use %{?_isa} for GDB dependency. Recommend
    GDB, instead of requiring it.


author: Nils Philippsen <nils@tiptoe.de> - 0.1.9-1
changelog:
  - version 0.1.9
  - change license to BSD (2-clause)
  - require gcc, alsa-lib-devel, fftw-devel for building


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-2.1
changelog:
  - Use Python distutils to install SELinux python bindings (#1719771)
  - Move  sefcontext_compile to -utils package (#1612518)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-6
changelog:
  - Describe fcontext regular expressions (#1904059)
  - Strip spaces before values in config (#2012145)


author: Petr Lautrbach <lautrbach@redhat.com> - 2.9-10
changelog:
  - Close old selabel handle when setting a new one (RHEL-73348)
  - Fix NULL pointer use in selinux_restorecon_set_sehandle (RHEL-74252)


author: Petr Lautrbach <plautrba@redhat.com> - 2.9-5
changelog:
  - Revert "genhomedircon: check usepasswd" (rhbz#1871786)
  - semanage.conf - improve usepasswd=False explanation (rhbz#1871786)
  - semanage.conf - expand list of ignoredirs (rhbz#1871786)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-7
changelog:
  - Trivial style fixes
  - Free contents of modkey in semanage_direct_remove
  - Fix USE_AFTER_FREE (CWE-672) in semanage_direct_write_langext()
  - add missing include to boolean_record.c
  - move module hashing into libsemanage
  - move compressed file handling into a separate object
  - clean up semanage_direct_commit() a bit
  - optionally rebuild policy when modules are changed externally
  - add command-line option to detect module changes (#2049186)


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-9
changelog:
  - allow spaces in user/group names (#2042408)
  - always write kernel policy when check_ext_changes is specified (#2089802)


author: Petr Lautrbach <lautrbach@redhat.com> - 2.9-11
changelog:
  - Set new restorecon handle before doing restorecon (RHEL-73348)
  - Mute error messages from selinux_restorecon


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-2
changelog:
  - reset pointer after free in cil_strpool_destroy()
  - cil: Add ability to redeclare types[attributes]
  - cil: Keep attributes used by generated attributes in neverallow rules
  - use IN6ADDR_ANY_INIT to initialize IPv6 addresses
  - fix memory leak in sepol_bool_query()
  - cil: drop wrong unused attribute
  - cil: fix -Wwrite-strings warning
  - cil: __cil_post_db_neverallow_attr_helper() does not use extra_args


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-5
changelog:
  - cil: Create new keep field for type attribute sets
  - build: follow standard semantics for DESTDIR and PREFIX
  - cil: show an error when cil_expr_to_string() fails


author: Petr Lautrbach <plautrba@redhat.com> - 2.7-6
changelog:
  - Prevent freeing unitialized value in ibendport handling
  - Add support for the SCTP portcon keyword
  - Export sepol_polcap_getnum/name functions


author: Vit Mojzis <vmojzis@redhat.com> - 2.9-3
changelog:
  - cil: Fix out-of-bound read of file context pattern ending with "\"
  - cil: Destroy classperms list when resetting classpermission (#1983517)
  - cil: Destroy classperm list when resetting map perms (#1983521)
  - cil: cil_reset_classperms_set() should not reset classpermission (#1983525)
  - cil: Set class field to NULL when resetting struct cil_classperms
  - cil: More strict verification of constraint leaf expressions
  - cil: Exit with an error if declaration name is a reserved word
  - cil: Allow permission expressions when using map classes
  - cil: Reorder checks for invalid rules when building AST
  - cil: Cleanup build AST helper functions
  - cil: Create new first child helper function for building AST
  - cil: Remove unused field from struct cil_args_resolve
  - cil: Destroy disabled optional blocks after pass is complete
  - cil: Check if name is a macro parameter first
  - cil: fix NULL pointer dereference in __cil_insert_name
  - cil: Report disabling an optional block only at high verbose levels
  - cil: Use AST to track blocks and optionals when resolving
  - cil: Reorder checks for invalid rules when resolving AST
  - cil: Sync checks for invalid rules in booleanifs
  - cil: Check for statements not allowed in optional blocks (#1983530)


author: Andreas Schneider <asn@redhat.com> - 4.9.1-5
changelog:
  - resolves: #1644327 - Segfault if wrong 'passdb backend' is configured
  - resolves: #1647959 - Segfault in the debug system with hardended build


author: Andreas Schneider <asn@redhat.com> - 4.9.1-6
changelog:
  - resolves: #1642092 - Harden [homes] share export
  - resolves: #1648846 - Fix out of bound array access in ctdb
  - resolves: #1657266 - Fix tmp directory creation in /run


author: Andreas Schneider <asn@redhat.com> - 4.9.1-7
changelog:
  - resolves: #1658690 - Add smbc_setOptionProtocols()
  - resolves: #1658678 - Fix spoolss client operations against Windows


author: Andreas Schneider <asn@redhat.com> - 4.10.4-0
changelog:
  - related: #1638001 - Rebase to Samba version 4.10.4
  - resolves: #1597298 - Build Samba with python3
  - resolves: #1658558 - Add 'net ads leave --keep-account' option
  - resolves: #1669004 - Fix systemd status notifications
  - resolves: #1672167 - Fix printing cache timeout in debug output
  - resolves: #1696525 - Fix CVE-2019-3880


author: Andreas Schneider <asn@redhat.com> - 4.10.4-1
changelog:
  - resolves: #1712378 - Fix smbspool CUPS backend
  - resolves: #1696612 - Fix 'net ads join -U admin@parentdomain'


author: Andreas Schneider <asn@redhat.com> - 4.10.4-100
changelog:
  - resolves: #1760824 - Avoid overlinking with librt and libpthread
  - resolves: #1759236 - Fix forest trusts enumeration
  - resolves: #1761719 - Fix CUPS username/password authentication with smbspool


author: Andreas Schneider <asn@redhat.com> - 4.11.2-4
changelog:
  - related: #1754409 - Add patch to avoid overlinking with libnsl and libsocket
  - related: #1754409 - Fix permissions for pidl
  - related: #1754409 - Fix logrotate script
  - related: #1754409 - Add missing README files


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.11.2-10
changelog:
  - resolves: #1790353 - Fix access check in DsRGetForestTrustInformation
  - resolves: #1791209 - Fix CVE-2019-14907


author: Andreas Schneider <asn@redhat.com> - 4.11.2-12
changelog:
  - related: #1781232 - Improve debug output of smbclient
  - resolves: #1794461 - Do not return bogus inode numbers in
                         cli_qpathinfo2()/cli_qpathinfo3() for SMB1
  - resolves: #1794442 - Fix segfault in smbd_do_qfilepathinfo()


author: Sushmita Bhattacharya <sushmita.bhattacharya@oracle.com> - 4.11.2-13.0.1
changelog:
  - Fix issues with join using netbios name [Orabug: 31546649]
  - related : samba bug #14116 - Join using netbios name and realm instead of machine fqdn
  - resolves: samba bug #14396 - Add msDS-AdditionalDnsHostName to the keytab and add net-ads-join dnshostname option
  - resolves: samba bug #14406 - Fix adding msDS-AdditionalDnsHostName to keytab with Windows DC


author: Andreas Schneider <asn@redhat.com> - 4.12.3-1
changelog:
  - resolves: #1666737 - Add a new smbc_readdirplus2() function to libsmbclient
  - resolves: #1842844 - Fix GnuTLS priority list for TLS connections


author: Isaac Boukris <iboukris@redhat.com> - 4.12.3-4
changelog:
  - resolves: #1850980 - Add "additional dns hostname" to keytab
  - resolves: #1850981 - Add net-ads-join dnshostname=fqdn option


author: Andreas Schneider <asn@redhat.com> - 4.12.3-5
changelog:
  - resolves: #1823612 - Fix segfault in 'net ads dns gethostbyname'
  - resolves: #1792553 - Fix 'net ads join createcomputer=OU'


author: Andreas Schneider <asn@redhat.com> - 4.12.3-7
changelog:
  - resolves: #1855711 - Fix 'require_membership_of' documentation in
                         pam_winbind manpage


author: Andreas Schneider <asn@redhat.com> - 4.12.3-9
changelog:
  - related: #1817557 - Move DECRPC mdssvc data files to correct package
  - resolves: #1856676 - Fix lookuprids in winbind


author: Andreas Schneider <asn@redhat.com> - 4.13.2-1
changelog:
  - resolves: #1878109 - Rebase Samba to version 4.13.2
  - resolves: #1872833 - Add samba-winexe subpackage
  - resolves: #1891688 - Fix CVE-2020-14323
  - resolves: #1892633 - Fix CVE-2020-14318
  - resolves: #1892639 - Fix CVE-2020-14383
  - resolves: #1879835 - Fix CVE-2020-1472
  - resolves: #1888990 - Update smb.conf manpages to describe how to apply
                         config changes.
  - resolves: #1869702 - Fix %U substitution for 'valid users' option
  - resolves: #1818038 - Improve FIPS compliance


author: Andreas Schneider <asn@redhat.com> - 4.13.2-2
changelog:
  - related: #1869702 - Fix spoolss crash
  - resolves: #1896736 - Fix name lookups of FreeIPA users
  - resolves: #1899113 - Fix DFS links


author: Andreas Schneider <asn@redhat.com> - 4.13.3-3
changelog:
  - resolves: #1924615 - Fix a memcache bug when cache is full
  - resolves: #1924571 - Ensure that libwbclient has been updated before
                         restarting services


author: Andreas Schneider <asn@redhat.com> - 4.13.3-4
changelog:
  - resolves: #1964314 - Fix ldconfig warning about libsmbldap.so.2
  - resolves: #1964398 - Fix smbd trying to delete files with wrong permissions
  - resolves: #1969831 - Fix memory leak in RPC server


author: Andreas Schneider <asn@redhat.com> - 4.14.4-0
changelog:
  - related: rhbz#1944657 - Update to version 4.14.5
  - resolves: rhbz#1969787 - Fix memory leak in RPC server
  - resolves: rhbz#1954974 - Validate smb.conf option for domain members with testparm
  - resolves: rhbz#1963298 - Fix smbd trying to delete files with wrong permissions
  - resolves: rhbz#1890008 - Update rpcclient manpage to list all available commands
  - resolves: rhbz#1857254 - Update smbcacls manpage to document inhertance flags


author: Andreas Schneider <asn@redhat.com> - 4.14.4-1
changelog:
  - resolves: rhbz#1974792 - Create a subpackage for vfs-io-uring
  - resolves: rhbz#1965397 - Raise log level for dfs ENOENT debug message


author: Andreas Schneider <asn@redhat.com> - 4.14.4-4
changelog:
  - resolves: rhbz#2021163
    Fix CVE-2016-2124
  - resolves: rhbz#2021167
    Fix CVE-2021-23192
  - resolves: rhbz#2021171
    Fix CVE-2020-25717


author: Andreas Schneider <asn@redhat.com> - 4.14.5-5
changelog:
  - resolves: rhbz#2021493 - Add missing PAC buffer types to krb5pac.idl
  - related: rbhz#2021171 - Fix regression with 'allow trusted domains = no'


author: Andreas Schneider <asn@redhat.com> - 4.14.5-9
changelog:
  - resolves: rhbz#2046174 - Fix username map script regression of CVE-2020-25717
  - resolves: rhbz#2046160 - Fix possible segfault while joining a domain
  - resolves: rhbz#2046152 - Fix CVE-2021-44142


author: Andreas Schneider <asn@redhat.com> - 4.14.4-2
changelog:
  - resolves: rhbz#1944657 - Update to version 4.14.4
  - resolves: rhbz#1949445 - Fix CVE-2021-20254
  - resolves: rhbz#1947945 - Fix libsmbldap.so.2 not being a symbolic link
  - resolves: rhbz#1908506 - Fix creating the gencache user directory
  - resolves: rhbz#1901029 - Build the vfs_io_uring module


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-0
changelog:
  - Update to Samba 4.15.5
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2046127 - Fix CVE-2021-44141
  - resolves: rhbz#2046153 - Fix CVE-2021-44142
  - resolves: rhbz#2044404 - Printing no longer works on Windows 7
  - resolves: rhbz#2043154 - Fix systemd notifications
  - resolves: rhbz#2049602 - Disable NTLMSSP for ldap client connections (e.g. libads)


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-1
changelog:
  - resolves: #1995849 - [RFE] Change change password change prompt phrasing
  - resolves: #2029417 - virusfilter_vfs_openat: Not scanned: Directory or special file


author: Andreas Schneider <asn@redhat.com> - 4.15.5-5
changelog:
  - resolves: rhbz#2064325 - Fix 'create krb5 conf = yes` when a KDC has a
                             single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-8
changelog:
  - resolves: rhbz#2079303 - Fix username map for unix groups
  - resolves: rhbz#2079299 - PAM Kerberos authentication fails with a clock skew error
  - resolves: rhbz#2079304 - Fix UPNs handling in lookup_name*() calls


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.2-1
changelog:
  - resolves: rhbz#2013596 - Rebase to version 4.15.2
  - resolves: rhbz#1999294 - Remove noisy error message in winbindd
  - resolves: rhbz#1958881 - Don't require winbind being online for krb5 auth
                             with one-way trusts
  - resolves: rhbz#2019461 - Fix deleting directories with dangling symlinks


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.3-1
changelog:
  - related: rhbz#2013596 - Rebase to version 4.15.3
  - resolves: rhbz#2028029 - Fix possible null pointer dereference in winbind
  - resolves: rhbz#1912549 - Winexe: Kerberos Auth is respected via --use-kerberos=desired


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.4-0
changelog:
  - Update to Samba 4.15.4
  - related: rhbz#2013596 - Rebase Samba to the the latest 4.15.x release
  - resolves: rhbz#2039153 - Fix CVE-2021-20316
  - resolves: rhbz#1912549 - Winexe: Kerberos flag not invoking Kerberos Auth
  - resolves: rhbz#2039157 - Fix CVE-2021-43566
  - resolves: rhbz#2038148 - Failed to authenticate users after upgrade samba package to release samba-4.14.5-7
  - resolves: rhbz#2035528 - [smb] Segmentation fault when joining the domain
  - resolves: rhbz#2038796 - filename_convert_internal: open_pathref_fsp [xxx] failed: NT_STATUS_ACCESS_DENIED


author: Pavel Filipenský <pfilipen@redhat.com> - 4.15.5-6
changelog:
  - resolves: rhbz#2059151 - Fix username map for unix groups
  - resolves: rhbz#2065212 - Fix 'create krb5 conf = yes` when a KDC has a single IP address.


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.3-0
changelog:
  - related: rhbz#2077468 - Rebase Samba to 4.16.3
  - resolves: rhbz#2106672 - The pcap background queue process should not be stopped
  - resolves: rhbz#2106263 - Fix crash in rpcd_classic
  - resolves: rhbz#2100093 - Fix net ads info returns LDAP server and LDAP server name


author: Pavel Filipenský <pfilipen@redhat.com> - 4.16.4-5
changelog:
  - resolves: rhbz#2170394 - Fix share enum
  - resolves: rhbz#2170467 - Add to package ctdb dependency for package samba-winbind-clients
  - resolves: rhbz#2170468 - Add package dcerpc - fix winbind to retrieve user groups from AD
  - resolves: rhbz#2170469 - Create package samba-tools


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc3-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc3
  - resolves: #1554753 - Fix CVE-2018-1050
  - resolves: #1617912 - Fix CVE-2018-10858
  - resolves: #1617913 - Fix CVE-2018-10918
  - resolves: #1617914 - Fix CVE-2018-10919
  - resolves: #1617915 - Fix CVE-2018-1139
  - resolves: #1612522 - Manpage fixes


author: Andreas Schneider <asn@redhat.com> - 4.9.0rc5-3
changelog:
  - related: #1614232 - Update to Samba 4.9.0rc5
  - resolves: #1610909 - Re-enable glubsterfs vfs module
  - resolves: #1624170 - Build with -fstack-protectore-strong if available
  - resolves: #1602685 - Fixed issues found by covscan


author: Alexander Bokovoy <abokovoy@redhat.com> - 4.9.1-3
changelog:
  - Temporarily remove smbtorture from samba-test due to Python 2 linkage
  - related: #1609661 - samba-test package cannot be installed due to unresolved dependencies


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-1
changelog:
  - updated to 1.0.28
  - fix possible buffer overflow when parsing crafted ID3 tags (#1440758, CVE-2017-7586)
  - fix possible buffer overflow when parsing crafted flac file (#1440756, CVE-2017-7585)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10
changelog:
  - fix CVE-2018-19661 and CVE-2018-19662 - buffer over-read in the function
    i2alaw_array in alaw (#1673085)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-10.1
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985027)


author: Michal Hlavinka <mhlavink@redhat.com> - 1.0.28-11
changelog:
  - a crafted wav file could cause heap buffer overflow that allowed an arbitrary code execution(#1985028)


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.4-1
changelog:
  - soname bump to "1"
  - incompatible API changes:
    * bindings: Selection.flags is now an attribute
    * repodata_lookup_num now works like the other lookup_num functions
  - new functions:
    * selection_make_matchsolvable
    * selection_make_matchsolvablelist
    * pool_whatmatchessolvable
    * repodata_search_arrayelement
    * repodata_lookup_kv_uninternalized
    * repodata_search_uninternalized
    * repodata_translate_dir
  - new repowriter interface to write solv files allowing better
    control over what gets written
  - support for filtered file lists with a custom filter
  - dropped support of (since a long time unused) REPOKEY_TYPE_U32
  - selected bug fixes:
    * fix nasty off-by-one error in repo_write
    * do not autouninstall packages because of forcebest updates
    * fixed a couple of null pointer derefs and potential memory
      leaks
    * made disfavoring recommended packages work if strong recommends
      is enabled
    * no longer disable infarch rules when they don't conflict with
      the job
    * repo_add_rpmdb: do not copy bad solvables from the old solv file
    * fix cleandeps updates not updating all packages
  - new features:
    * support rpm's new '^' version separator
    * support set/get_considered_list in bindings
    * new experimental SOLVER_FLAG_ONLY_NAMESPACE_RECOMMENDED flag
    * do favor evaluation before pruning allowing to (dis)favor
      specific package versions
    * bindings: support pool.matchsolvable(), pool.whatmatchessolvable()
      pool.best_solvables() and selection.matchsolvable()
    * experimental DISTTYPE_CONDA and REL_CONDA support


author: Ales Matej <amatej@redhat.org> - 0.7.7-1
changelog:
  - Update to 0.7.7
  - selected bug fixes:
    * fix updating of too many packages in focusbest mode
    * fix handling of disabled installed packages in distupgrade
    * fix repository priority handling for multiversion packages
    * better support of inverval deps in pool_match_dep()
    * support src rpms that have non-empty provides
    * fix favorq leaking between solver runs if the solver is reused
    * fix SOLVER_FLAG_FOCUS_BEST updateing packages without reason
    * be more correct with multiversion packages that obsolete their
      own name
    * allow building with swig-4.0.0
    * lock jobs now take precedence over dup and forcebest jobs
  - new features
    * new POOL_FLAG_WHATPROVIDESWITHDISABLED pool flag 
    * bindings: add get_disabled_list() and set_disabled_list()
    * bindings: add whatcontainsdep()
    * bindings: make the selection filters return the self object
    * MSVC compilation support


author: Ales Matej <amatej@redhat.org> - 0.7.11-1
changelog:
  - Update to 0.7.11
  - selected bug fixes:
    * support arch<->noarch package changes when creating patch
      conflicts from the updateinfo data
    * also support other rpm database types
    * fixed solv_zchunk decoding error if large chunks are used
    * treat retracted pathes as irrelevant
    * made add_update_target work with multiversion installs
  - new features
    * support for SOLVER_BLACKLIST jobs that block the installation of matched
      packages unless they are directly selected by an SOLVER_INSTALL job
    * libsolv now also parses the patch status in the updateinfo parser
    * new solvable_matchessolvable() function
    * support conda constrains dependencies
    * new rpm_stat_database() function
    * new rpm_hash_database_state() function


author: Nicola Sella <nsella@redhat.com> - 0.7.16-1
changelog:
  - Update to 0.7.16
  - selected bug fixes:
    * make testcase_mangle_repo_names deal correctly with freed repos
    [bnc#1177238]
    * fix add_complex_recommends() selecting conflicted packages in
      rare cases leading to crashes
    * improve choicerule generation so that package updates are
      prefered in more cases
    * fix deduceq2addedmap clearing bits outside of the map
    * conda: feature depriorization and fix startswith implementation
    * Fix solvable swapping messing up idarrays
    * fix ruleinfo of complex dependencies returning the wrong origin
    * fix solv_zchunk decoding error if large chunks are used
      [bnc#1159314]
  - new features
    * new testcase_mangle_repo_names() function
    * new solv_fmemopen() function
    * Enable zstd compression support for sle15 and sle15-sp2
    * Support blacklisted packages in solver_findproblemrule()
      [bnc#1172135]
    * Support rules with multiple negative literals in choice rule
      generation
    * build with -DENABLE_RPMDB_LIBRPM=1 on SUSE to support
      multiple rpm database backends
    * added two new function to make libzypp independent of the rpm
      database format
    * support conda constrains dependencies


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.17-1
changelog:
  - Update to 0.7.17
  - selected bug fixes:
    * repo_write: fix handling of nested flexarray
    * improve choicerule generation a bit more to cover more cases
    * harden testcase parser against repos being added too late
    * support python-3.10
    * check /var/lib/rpm macro in rpmdb code
  - new features:
    * handle default/visible/langonly attributes in comps parser
    * support multiple collections in updateinfo parser
    * add '-D' option in rpmdb2solv to set the dbpath


author: Pavla Kratochvilova <pkratoch@redhat.org> - 0.7.19-1
changelog:
  - Update to 0.7.19
  - repo_add_conda: add flag to skip v2 packages
  - fix rare segfault in resolve_jobrules() that could happen if new rules are learnt
  - fix error handling in solv_xfopen_fd()
  - fix memory leaks


author: Pavla Kratochvilova <pkratoch@redhat.com> - 0.7.20-1
changelog:
  - Update to 0.7.20
  - new SOLVER_EXCLUDEFROMWEAK job to ignore pkgs for weak dependencies
  - support for environments in comps parser
  - fix misparsing of '&' in attributes with libxml2
  - choice rules: treat orphaned packages as newest
  - fix compatibility with Python 3.10


author: Jaroslav Rohel <jrohel@redhat.com> - 0.7.20-5
changelog:
  - Backport Treat condition both as positive and negative literal in pool_add_pos_literals_complex_dep
    (RhBug:2185061,2190136)


author: Rex Dieter <rdieter@fedoraproject.org> - 0.2.8-5
changelog:
  - BR: libgs-devel (f28+)
  - .spec cleanup/cosmetics (drop deprecated tags, use %autosetup/%license, tighten subpkg dep)


author: Paul Howarth <paul@city-fan.org> - 1.7.0-5
changelog:
  - Revert parts of previous change that broke EL-5 compatibility
  - Include NEWS in docs package, it's much more than RELEASE-NOTES


author: Paul Howarth <paul@city-fan.org> - 1.8.0-1
changelog:
  - Update to 1.8.0
    - Added a basic dockerised test suite
    - crypto: Add support for the mbedTLS backend
    - See RELEASE-NOTES for details of bug fixes


author: Paul Howarth <paul@city-fan.org> - 1.8.0-5
changelog:
  - scp: Do not NUL-terminate the command for remote exec (#1489736, GH#208)
  - Make devel package dependency on main package arch-specific
  - Drop EL-5 support
    - noarch sub-packages always available now
    - Drop legacy Group: and BuildRoot: tags
    - Drop explicit buildroot cleaning
    - %{__isa_bits} always defined now


author: Kamil Dudka <kdudka@redhat.com> 1.8.0-7.el8_0.1
changelog:
  - fix integer overflow in keyboard interactive handling that allows out-of-bounds writes (CVE-2019-3863)
  - fix integer overflow in SSH packet processing channel resulting in out of bounds write (CVE-2019-3857)
  - fix integer overflow in keyboard interactive handling resulting in out of bounds write (CVE-2019-3856)
  - fix integer overflow in transport read resulting in out of bounds write (CVE-2019-3855)


author: Michal Židek <mzidek@redhat.com> - 2.0.0-33
changelog:
  - Resolves: rhbz#1646113 - Missing concise documentation about valid options
                             for sssd-files-provider


author: Michal Židek <mzidek@redhat.com> - 2.0.0-34
changelog:
  - Resolves: rhbz#1622008 - Error message when IPA server uninstall calls
                             kdestroy caused by KCM returning a wrong error
                             code during the delete operation


author: Michal Židek <mzidek@redhat.com> - 2.0.0-36
changelog:
  - Resolves: rhbz#1652563 - incorrect example in the man page of idmap_sss
                             suggests using * for backend sss


author: Michal Židek <mzidek@redhat.com> - 2.0.0-38
changelog:
  - Resolves: rhbz#1578014 - sssd does not work under non-root user
  - Note: Actually the patches were in the 2.0.0-37, this one just adds this
          changelog because it was missing.


author: Michal Židek <mzidek@redhat.com> - 2.0.0-39
changelog:
  - Resolves: rhbz#1661183 - SSSD 2.0 has drastically lower sbus timeout than
                             1.x, this can result in time outs


author: Michal Židek <mzidek@redhat.com> - 2.0.0-40
changelog:
  -Resolves: rhbz#1660083 - extraAttributes is org.freedesktop.DBus.Error.
                            UnknownProperty: Unknown property


author: Michal Židek <mzidek@redhat.com> - 2.0.0-41
changelog:
  -Resolves: rhbz#1659498 - Re-setting the trusted AD domain fails due to wrong
                            subdomain service name being used


author: Michal Židek <mzidek@redhat.com> - 2.0.0-42
changelog:
  - Resolves: rhbz#1645291 - Perform some basic ccache initialization as part
                             of gen_new to avoid a subsequent switch call
                             failure


author: Jakub Hrozek <jhrozek@redhat.com> - 2.0.0-43
changelog:
  - Resolves: rhbz#1672780 - gdm login not prompting for username when smart
                             card maps to multiple users


author: Michal Židek <mzidek@redhat.com> - 2.2.0-10
changelog:
  - Resolves: rhbz#1736483 - Sudo prompt for smart card authentication is missing
                             the trailing colon


author: Michal Židek <mzidek@redhat.com> - 2.2.0-11
changelog:
  - Resolves: rhbz#1733372 - permission denied on logs when running sssd as
                             non-root user


author: Michal Židek <mzidek@redhat.com> - 2.2.0-13
changelog:
  - Resolves: rhbz#1669407 - MAN: Document that PAM stack contains the
              systemd-user service in the account phase in RHEL-8


author: Michal Židek <mzidek@redhat.com> - 2.2.0-14
changelog:
  - Resolves: rhbz#1736796 - sssd config option "default_domain_suffix"
                             should not cause files domain entries to be
                             qualified, this can break sudo access


author: Michal Židek <mzidek@redhat.com> - 2.2.0-15
changelog:
  - Resolves: rhbz#1736265 - Smart Card auth of local user: endless
                             loop if wrong PIN was provided


author: Michal Židek <mzidek@redhat.com> - 2.2.0-16
changelog:
  - Resolves: rhbz#1736861 - dyndns_update = True is no longer enough to get
                             the IP address of the machine updated in IPA upon
                             sssd.service startup


author: Michal Židek <mzidek@redhat.com> - 2.2.0-17
changelog:
  - Resolves: rhbz#1676385 - pam_sss with smartcard auth does not create gnome
                             keyring
  - Also apply a patch to fix gating tests issue


author: Michal Židek <mzidek@redhat.com> - 2.2.0-18
changelog:
  - Resolves: rhbz#1744134 - New defect found in sssd-2.2.0-16.el8
  - Also sync. kcm multihost tests with master


author: Michal Židek <mzidek@redhat.com> - 2.2.0-19
changelog:
  - Resolves: rhbz#1712875 - Old kerberos credentials active instead of valid
                             new ones (kcm)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.0-19.1
changelog:
  - Resolves: rhbz#1816591 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module does not
                             implement it properly [rhel-8.1.0.z]


author: Michal Židek <mzidek@redhat.com> - 2.2.3-14
changelog:
  - Resolves: rhbz#1767514 - sssd requires timed sudoers ldap entries to be
                             specified up to the seconds


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-16
changelog:
  - Resolves: rhbz#1792331 - sssd_be crashes when krb5_realm and krb5_server is
                             omitted and auth_provider is krb5


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-17
changelog:
  - Resolves: rhbz#1718193 - p11_child should have an option to skip
                             C_WaitForSlotEvent if the PKCS#11 module
                             does not implement it properly


author: Michal Židek <mzidek@redhat.com> - 2.2.3-18
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1810634 - id command taking 1+ minute for returning user
                             information


author: Alexey Tikhonov <atikhono@redhat.com> - 2.2.3-19
changelog:
  - Resolves: rhbz#1580506 - [RFE]: sssd to be able to read smartcard
                             certificate EKU and perform an action based
                             on value when generating SSH key from a certificate
                             (additional patch)


author: EL Errata <el-errata_ww@oracle.com> - 2.2.3-20.0.1.el8
changelog:
  - Revert Redhat's change of disallowing duplicated incomplete gid
    when "id_provider=ldap" is used, which caused regression in AD
    environment. [Orabug: 29286774] [Doc ID 2605732.1]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-1
changelog:
  - Resolves: rhbz#1839037 - Rebase SSSD for RHEL 8.3
  - Resolves: rhbz#1843872 - sssd 2.3.0 breaks AD auth due to GPO parsing failure
  - Resolves: rhbz#1834156 - sssd or sssd-ad not updating their dependencies on "yum update" which breaks working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-2
changelog:
  - Resolves: rhbz#Bug 1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-3
changelog:
  - Resolves: rhbz#1829470 - `sssd.api.conf` and `sssd.api.d` should belong to `python-sssdconfig` package
  - Resolves: rhbz#1544457 - sssd fails to release file descriptor on child logs after receiving HUP
  - Resolves: rhbz#1824323 - SSSD user filtering is failing on RHEL 8 after "files" provider rebuilds cache
  - Resolves: rhbz#1827432 - When the passwd or group files are replaced, sssd stops monitoring the file for
                             inotify events, and no updates are triggered
  - Resolves: rhbz#1835710 - Change the message "Please enter smart card" to "Please insert smart card"
                             on GDM login with smart-card
  - Resolves: rhbz#1838037 - Oddjob-mkhomedir fails when using NSS compat
  - Resolves: rhbz#1845904 - gdm smart card authentication does not work shortly after disconnecting from network.
  - Resolves: rhbz#1845975 - sssd doesn't follow the link order of AD Group Policy Management
  - Resolves: rhbz#1845980 - sssd is failing to discover other subdomains in the forest
                             if LDAP entries do not contain AD forest root information
  - Resolves: rhbz#1845987 - Document how to prevent invalid selinux context for default home directories
                             in SSSD-AD direct integration.
  - Resolves: rhbz#1845994 - GDM failure loop when no user mapped for smart card
  - Resolves: rhbz#1846003 - GDM password prompt when cert mapped to multiple users and promptusername is False
  - Resolves: rhbz#1850961 - /usr/share/systemtap/tapset/sssd_functions.stp missing a comma


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-4
changelog:
  - Resolves: rhbz#1815584 - id_provider = proxy proxy_lib_name = files returns * in password field, breaking PAM authentication
  - Resolves: rhbz#1794607 - SSSD must be able to resolve membership involving root with files provider
  - Resolves: rhbz#1803134 - Improve "unlock" time when user session already active


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-5
changelog:
  - Resolves: rhbz#1821719 - sssd (sssd_be) is consuming 100% CPU, partially due to failing mem-cache
  - Fixed "requires/provides" rpmdiff warning


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-7
changelog:
  - Resolves: rhbz#1723273 - RFE: Add option to specify alternate sssd config file location with "sssctl config-check" command.
  - Resolves: rhbz#1780404 - smartcards: special characters must be escaped when building search filter


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-8
changelog:
  - Resolves: rhbz#1868387 - system not enforcing GPO rule restriction. ad_gpo_implicit_deny = True is not working
  - Resolves: rhbz#1854951 - sss-certmap man page change to add clarification for userPrincipalName attribute from AD schema
  - Resolves: rhbz#1856861 - False errors/warnings are logged in sssd.log file after enabling 2FA prompting settings in sssd.conf
  - Resolves: rhbz#1869683 - p11_child: default value of ocsp_dgst == sha256 doesn't conform RFC5019 and has to be changed to sha1


author: Alexey Tikhonov <atikhono@redhat.com> - 2.3.0-9
changelog:
  - Resolves: rhbz#1855323 - When ad_gpo_implicit_deny is True, it is permitting users to login when no gpo is applied


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-1
changelog:
  - Resolves: rhbz#1881992 - Rebase SSSD for RHEL 8.4
  - Resolves: rhbz#1722842 - sssd-kcm does not store TGT with ssh login using GSSAPI
  - Resolves: rhbz#1734040 - sssd crash in ad_get_account_domain_search()
  - Resolves: rhbz#1784459 - [RFE] tlog does not allow to exclude some users from session recording
  - Resolves: rhbz#1791300 - sporadic sssd_be crash on s390x
  - Resolves: rhbz#1817122 - 'getent group ldapgroupname' doesn't show any LDAP users or some LDAP users when 'rfc2307bis' schema is used with SSSD.
  - Resolves: rhbz#1819012 - [RFE] Improve AD site discovery process
  - Resolves: rhbz#1846778 - [RfE] `/usr/libexec/sssd/p11_child` cmdline argument '--nssdb' might be confusing when SSSD was built against OpenSSL
  - Resolves: rhbz#1873715 - automount sssd issue when 2 automount maps have the same key (one un uppercase, one in lowercase)
  - Resolves: rhbz#1879860 - correction in sssd.conf:pam_response_filter man page
  - Resolves: rhbz#1881336 - [RFE] sssd-ldap man page modification for parameter "ldap_referrals"
  - Resolves: rhbz#1883488 - [RfE] Implement a new sssd.conf option to disable the filter for AD domain local groups from trusted domains
  - Resolves: rhbz#1884196 - [RFE] Add "enabled" option to domain section in config file
  - Resolves: rhbz#1884205 - KCM: Increase client idle timeout to 5 minutes
  - Resolves: rhbz#1884207 - [RFE] ldap: add new option ldap_library_debug_level
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff
  - Resolves: rhbz#1884281 - Secondary LDAP group go missing from 'id' command
  - Resolves: rhbz#1884301 - [RFE] dyndns: suport asymmetric auth for nsupdate


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-3
changelog:
  - Resolves: rhbz#1900733 - sssd_be segfaults at be_refresh_get_values_ex() due to NULL ptrs in results of sysdb_search_with_ts_attr()
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1894540 - sssd component logging is now too generic in syslog/journal
  - Resolves: rhbz#1828483 - filtered ID is appearing due to strange negative cache behavior


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-4
changelog:
  - Resolves: rhbz#1876514 - High CPU utilization by the sssd_kcm process
  - Resolves: rhbz#1876658 - filter_groups option partially filters the group from 'id' output of the user because gidNumber still appears in 'id' output [RHEL 8]
  - Resolves: rhbz#1895001 - User lookups over the InfoPipe responder fail intermittently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-5
changelog:
  - Resolves: rhbz#1631410 - Can't login with smartcard with multiple certs having same ID value
  - Resolves: rhbz#1884213 - [RFE] add offline_timeout_max config option to control offline interval backoff (additional patches)
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-6
changelog:
  - Resolves: rhbz#1113639 - autofs: return a connection failure until maps have been fetched
  - Resolves: rhbz#1915395 - Memory leak in the simple access provider
  - Resolves: rhbz#1915319 - SSSD: SBUS: failures during servers startup
  - Resolves: rhbz#1893698 - [RFE] sudo kerberos authentication (additional patches)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-7
changelog:
  - Resolves: rhbz#1920001 - Do not add '%' to group names already prefixed with '%' in IPA sudo rules
  - Resolves: rhbz#1918433 - sssd unable to lookup certmap rules
  - Resolves: rhbz#1917382 - [abrt] [faf] sssd: dp_client_handshake_timeout(): /usr/libexec/sssd/sssd_be killed by 11


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-8
changelog:
  - Resolves: rhbz#1926622 - Add support to verify authentication indicators in pam_sss_gss
  - Resolves: rhbz#1926454 - First smart refresh query contains modifyTimestamp even if the modifyTimestamp is 0.
  - Resolves: rhbz#1893159 - Default debug level should report all errors / failures (additional patch)


author: EL Errata <el-errata_ww@oracle.com> - 2.4.0-9.0.1
changelog:
  - Restore default debug level for sss_cache [Orabug: 32810448]
  - Restore default debug level for shadow-utils tools [Orabug: 32810448]
  - Revert Redhat's change of disallowing duplicated incomplete gid
    when "id_provider=ldap" is used, which caused regression in AD
    environment. [Orabug: 29286774] [Doc ID 2605732.1]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.1
changelog:
  - Resolves: rhbz#1949170 - pam_sss_gss.so doesn't work with large kerberos tickets [rhel-8.4.0.z]
  - Resolves: rhbz#1945656 - No gpo found and ad_gpo_implicit_deny set to True still permits user login [rhel-8.4.0.z]
  - Resolves: rhbz#1945655 - SSSD not detecting subdomain from AD forest (RHEL 8.3) [rhel-8.4.0.z]
  - Resolves: rhbz#1945654 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7 [rhel-8.4.0.z]
  - Resolves: rhbz#1942438 - Wrong default debug level of sssd tools [rhel-8.4.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.4.0-9.2
changelog:
  - Resolves: rhbz#1985456 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8.4.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.0-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1930535 - [abrt] [faf] sssd: monitor_service_shutdown(): /usr/sbin/sssd killed by 11
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1945888 - Inconsistant debug level for connection logging
  - Resolves: rhbz#1948657 - pam_sss_gss.so doesn't work with large kerberos tickets
  - Resolves: rhbz#1949149 - [RFE] Poor man's backtrace
  - Resolves: rhbz#1920500 - Authentication handshake (ldap_install_tls()) fails due to underlying openssl operation failing with EINTR
  - Resolves: rhbz#1923964 - [RFE] SSSD Error Msg Improvement: write_krb5info_file failed, authentication might fail.
  - Resolves: rhbz#1928648 - SSSD logs improvements: clarify which config option applies to each timeout in the logs
  - Resolves: rhbz#1632159 - sssd-kcm starts successfully for non existent socket_path
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm
  - Resolves: rhbz#1925505 - [RFE] improve the sssd refresh timers for SUDO queries
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1925561 - sssd-ldap(5) does not report how to disable the SUDO smart queries
  - Resolves: rhbz#1925621 - document impact of indices and of scope on performance of LDAP queries
  - Resolves: rhbz#1855320 - [RFE] RHEL8 sssd: inheritance of the case_sensitive parameter for subdomains.
  - Resolves: rhbz#1925608 - [RFE] make 'random_offset' addon to 'offline_timeout' option configurable
  - Resolves: rhbz#1447945 - man page / docs update required: if two certificate matching rules with the same priority match only one is used
  - Resolves: rhbz#1703436 - sssd not thread-safe in innetgr()
  - Resolves: rhbz#1713143 - SSSD does not translate the 2FA text labels("first factor" / "second factor") on GDM login and screensaver unlock screen
  - Resolves: rhbz#1888977 - sss_override: Usage limitations clarification in man page
  - Resolves: rhbz#1890177 - Clarify "single_prompt" option in "PROMPTING CONFIGURATION SECTION" section of sssd.conf man page
  - Resolves: rhbz#1902280 - fix sss_cache to also reset cached timestamp
  - Resolves: rhbz#1935683 - SSSD not detecting subdomain from AD forest (RHEL 8.3)
  - Resolves: rhbz#1937919 - IPA missing secondary IPA Posix groups in latest sssd 1.16.5-10.el7_9.7
  - Resolves: rhbz#1944665 - No gpo found and ad_gpo_implicit_deny set to True still permits user login
  - Resolves: rhbz#1919942 - sss_override does not take precedence over override_homedir directive


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1942387 - Wrong default debug level of sssd tools
  - Resolves: rhbz#1917444 - SSSD Error Msg Improvement: Server resolution failed: [2]: No such file or directory
  - Resolves: rhbz#1917511 - SSSD Error Msg Improvement: Failed to resolve server 'server.example.com': Error reading file
  - Resolves: rhbz#1917535 - sssd.conf man page: parameter dns_resolver_server_timeout and dns_resolver_op_timeout
  - Resolves: rhbz#1940509 - [RFE] Health and Support Analyzer: Link frontend to backend requests
  - Resolves: rhbz#1649464 - auto_private_groups not working as expected with posix ipa/ad trust
  - Resolves: rhbz#1925514 - [RFE] Randomize the SUDO timeouts upon reconnection
  - Resolves: rhbz#1961215 - Invalid sssd-kcm return code if requested operation is not found
  - Resolves: rhbz#1837090 - SSSD fails nss_getby_name for IPA user with SID if the user has user private group
  - Resolves: rhbz#1879869 - sudo commands incorrectly exports the KRB5CCNAME environment variable
  - Resolves: rhbz#1962550 - sss_pac_make_request fails on systems joined to Active Directory.
  - Resolves: rhbz#1737489 - [RFE] SSSD should honor default Kerberos settings (keytab name) in /etc/krb5.conf


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.1-2
changelog:
  - Resolves: rhbz#1974257 - 'debug_microseconds' config option is broken
  - Resolves: rhbz#1936902 - SSSD Error Msg Improvement: Invalid argument
  - Resolves: rhbz#1627112 - RFE: Kerberos ticket renewal for sssd-kcm (additional patches and rebuild)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-1
changelog:
  - Resolves: rhbz#1947671 - Rebase SSSD for RHEL 8.5
  - Resolves: rhbz#1693379 - sssd_be and sss_cache too heavy on CPU
  - Resolves: rhbz#1909373 - Missing search index for `originalADgidNumber`
  - Resolves: rhbz#1954630 - [RFE] Improve debug messages by adding a unique tag for each request the backend is handling
  - Resolves: rhbz#1936891 - SSSD Error Msg Improvement: Bad address
  - Resolves: rhbz#1364596 - sssd still showing ipa user after removed from last group
  - Resolves: rhbz#1979404 - Changes made to /etc/pam.d/sssd-shadowutils are overwritten back to default on sssd-common package upgrade


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2
changelog:
  - Resolves: rhbz#1975169 - EMBARGOED CVE-2021-3621 sssd: shell command injection in sssctl [rhel-8]
  - Resolves: rhbz#1962042 - [sssd] RHEL 8.5 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.1
changelog:
  - Resolves: rhbz#2014460 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.2
changelog:
  - Resolves: rhbz#2018440 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest) [rhel-8.5.0.z]
  - Resolves: rhbz#2016923 - autofs lookups for unknown mounts are delayed for 50s [rhel-8.5.0.z]
  - Resolves: rhbz#2021499 - Make backtrace less "chatty" (avoid duplicate backtraces) [rhel-8.5.0.z]
  - Resolves: rhbz#2013379 - Lookup with fully-qualified name does not work with 'cache_first = True' [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.3
changelog:
  - Resolves: rhbz#2028828 - pam responder does not call initgroups to refresh the user entry [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.5.2-2.4
changelog:
  - Resolves: rhbz#2030651 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries [rhel-8.5.0.z]
  - Resolves: rhbz#2035285 - AD Domain in the AD Forest Missing after sssd latest update [rhel-8.5.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.1-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#1968340 - 'exclude_groups' option provided in SSSD for session recording (tlog) doesn't work as expected
  - Resolves: rhbz#1952569 - SSSD should use "hidden" temporary file in its krb locator
  - Resolves: rhbz#1917970 - proxy provider: secondary group is showing in sssd cache after group is removed
  - Resolves: rhbz#1636002 - socket-activated services start as the sssd user and then are unable to read the confdb
  - Resolves: rhbz#2021196 - Make backtrace less "chatty" (avoid duplicate backtraces)
  - Resolves: rhbz#2018432 - 2.5.x based SSSD adds more AD domains than it should based on the configuration file (not trusted and from a different forest)
  - Resolves: rhbz#2015070 - Consistency in defaults between OpenSSH and SSSD
  - Resolves: rhbz#2013297 - disabled root ad domain causes subdomains to be marked offline
  - Resolves: rhbz#2013294 - Lookup with fully-qualified name does not work with 'cache_first = True'
  - Resolves: rhbz#2013218 - autofs lookups for unknown mounts are delayed for 50s
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013024 - Add support for CKM_RSA_PKCS in smart card authentication.
  - Resolves: rhbz#2013006 - [RFE] support subid ranges managed by FreeIPA
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012122 - tps tests fail with cross dependency on sssd debuginfo package: removal of 'sssd-libwbclient-debuginfo' is missing


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-1
changelog:
  - Resolves: rhbz#2011216 - Rebase SSSD for RHEL 8.6
  - Resolves: rhbz#2013260 - [RHEL8] Add ability to parse child log files
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#1961182 - Passwordless (GSSAPI) SSH not working due to missing "includedir /var/lib/sss/pubconf/krb5.include.d" directive in /etc/krb5.conf
  - Resolves: rhbz#2008829 - sssd_be segfault due to empty forest root name
  - Resolves: rhbz#2012263 - pam responder does not call initgroups to refresh the user entry
  - Resolves: rhbz#2012308 - Add client certificate validation D-Bus API
  - Resolves: rhbz#2012327 - Groups are missing while performing id lookup as SSSD switching to offline mode due to the wrong domain name in the ldap-pings(netlogon).
  - Resolves: rhbz#2013028 - [RFE] Health and Support Analyzer: Add sssctl sub-command to select and display a single request from the logs
  - Resolves: rhbz#2013259 - [RHEL8] Add tevent chain ID logic into responders
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-3
changelog:
  - Resolves: rhbz#2039892 - 2.6.2 regression: Daemon crashes when resolving AD user names
  - Resolves: rhbz#1859315 - sssd does not use kerberos port that is set.
  - Resolves: rhbz#2030386 - sssd-kcm has requirement on krb5 symbol "krb5_unmarshal_credentials" only available in latest RHEL8.5 krb5 libraries
  - Resolves: rhbz#2035245 - AD Domain in the AD Forest Missing after sssd latest update
  - Resolves: rhbz#2017301 - [sssd] RHEL 8.6 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-4
changelog:
  - Resolves: rhbz#2074648 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop [rhel-8.6.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.6.2-4.1
changelog:
  - Resolves: rhbz#2072958 - Use right sdap_domain in ad_domain_info_send [rhel-8.6.0.z]
  - Resolves: rhbz#2089244 - pam_sss_gss ceased to work after upgrade to 8.6 [rhel-8.6.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.0-2
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2026799 - SSSD authenticating to LDAP with obfuscated password produces Invalid authtoken type message causing sssd_be to go offline (cross inter_ference of different provider plugins options)
  - Resolves: rhbz#2033347 - sssd error triggers backtrace : [write_krb5info_file_from_fo_server] (0x0020): [RID#73501] There is no server that can be written into kdc info file.
  - Resolves: rhbz#2056483 - [RFE] Add sssd internal krb5 plugin for authentication against external IdP via OAuth2
  - Resolves: rhbz#2062689 - [Improvement] Add user and group version of sss_nss_getorigbyname()
  - Resolves: rhbz#2065692 - [RHEL8] Ship new sub-package called sssd-idp into sssd
  - Resolves: rhbz#2072050 - sssd_nss exiting (due to missing 'sssd' local user) making SSSD service to restart in a loop
  - Resolves: rhbz#2072931 - Use right sdap_domain in ad_domain_info_send
  - Resolves: rhbz#2087088 - sssd does not enforce smartcard auth for kde screen locker
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol
  - Resolves: rhbz#2087745 - 2FA prompting setting ineffective
  - Resolves: rhbz#2087746 - sssd fails GPO-based access if AD have setup with Japanese language


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.2-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2098620 - sdap_nested_group_deref_direct_process() triggers internal watchdog for large data sets
  - Resolves: rhbz#2098619 - [Improvement] add SSSD support for more than one CRL PEM file name with parameters certificate_verification and crl_file
  - Resolves: rhbz#2088817 - pam_sss_gss ceased to work after upgrade to 8.6
  - Resolves: rhbz#2098616 - Add idp authentication indicator in man page of sssd.conf
  - Resolves: rhbz#2056035 - 'getent hosts' not return hosts if they have more than one CN in LDAP
  - Resolves: rhbz#2098615 - Regression "Missing internal domain data." when setting ad_domain to incorrect
  - Resolves: rhbz#2098617 - Harden kerberos ticket validation
  - Resolves: rhbz#2087744 - Unable to lookup AD user if the AD group contains '@' symbol


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-1
changelog:
  - Resolves: rhbz#2069379 - Rebase SSSD for RHEL 8.7
  - Resolves: rhbz#2063016 - [sssd] RHEL 8.7 Tier 0 Localization


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-2
changelog:
  - Resolves: rhbz#2116488 - virsh command will hang after the host run several auto test cases
  - Resolves: rhbz#2116486 - [regression] sssctl analyze fails to parse PAM related sssd logs
  - Resolves: rhbz#2116487 - cache_req_data_set_hybrid_lookup: cache_req_data should never be NULL


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-3
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8
  - Resolves: rhbz#2119726 - sssctl analyze --logdir option requires sssd to be configured
  - Resolves: rhbz#2120669 - Incorrect request ID tracking from responder to backend


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4
changelog:
  - Resolves: rhbz#2116395 - NFS krb5 mount failed as "access denied" after test accessing a same file on krb5 nfs mount with multiple uids simultaneously since sssd-2.7.3-1.el8


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.1
changelog:
  - Resolves: rhbz#2128544 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict) [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.2
changelog:
  - Resolves: rhbz#2139871 - Analyzer: Optimize and remove duplicate messages in verbose list [rhel-8.7.0.z]
  - Resolves: rhbz#2142961 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged [rhel-8.7.0.z]
  - Resolves: rhbz#2148989 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-4.3
changelog:
  - Resolves: rhbz#2152883 - authenticating against external IdP services okta (native app) with OAuth client secret failed [rhel-8.7.0.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.7.3-5
changelog:
  - Related: rhbz#2132051 - Rebase Samba to the the latest 4.17.x release
    Rebuild against Samba rebase.


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.1-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2144581 - [RFE] provide dbus method to find users by attr
  - Resolves: rhbz#2144579 - sssd timezone issues sudonotafter
  - Resolves: rhbz#2144519 - [RFE] SSSD does not support to change the user’s password when option ldap_pwd_policy equals to shadow in sssd.conf file
  - Resolves: rhbz#2127822 - Cannot SSH with AD user to ipa-client (`krb5_validate` and `pac_check` settings conflict)
  - Resolves: rhbz#2111393 - authenticating against external IdP services okta (native app) with OAuth client secret failed


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-1
changelog:
  - Resolves: rhbz#2127511 - Rebase SSSD for RHEL 8.8
  - Resolves: rhbz#2136701 - Lower the severity of the log message for SSSD so that it is not shown at the default debug level.
  - Resolves: rhbz#2139760 - [sssd] RHEL 8.8 Tier 0 Localization
  - Resolves: rhbz#2139865 - Analyzer: Optimize and remove duplicate messages in verbose list
  - Resolves: rhbz#2142795 - SSSD: `sssctl analyze` command shouldn't require 'root' privileged
  - Resolves: rhbz#2144491 - UPN check cannot be disabled explicitly but requires krb5_validate = false' as a work-around
  - Resolves: rhbz#2150357 - Smart Card auth does not work with p11_uri (with-smartcard-required)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.8.2-2
changelog:
  - Resolves: rhbz#2149091 - Update to sssd-2.7.3-4.el8_7.1.x86_64 resulted in "Request to sssd failed. Device or resource busy"


author: Craig Guiller <craig.guiller@oracle.com> - 2.8.2-3.0.2
changelog:
  - [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'. (BZ#2196838)
  - SSSD enters failed state after heavy load in the system. (BZ#2219351)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2101489 - [sssd] Auth fails if client cannot speak to forest root domain (ldap_sasl_interactive_bind_s failed)
  - Resolves: rhbz#2143925 - kinit switches KCM away from the newly issued ticket
  - Resolves: rhbz#2151403 - AD user is not found on IPA client after upgrading to RHEL8.7
  - Resolves: rhbz#2164805 - man page entry should make clear that a nested group needs a name
  - Resolves: rhbz#2170484 - Unable to lookup AD user from child domain (or "make filtering of the domains more configurable")
  - Resolves: rhbz#2180981 - sss allows extraneous @ characters prefixed to username #


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.0-4
changelog:
  - Related: rhbz#2190417 - Rebase Samba to the latest 4.18.x release
    Rebuild against rebased Samba libs


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.1-1
changelog:
  - Resolves: rhbz#2167836 - Rebase SSSD for RHEL 8.9
  - Resolves: rhbz#2196521 - [RHEL8] sssd : AD user login problem when modify ldap_user_name= name and restricted by GPO Policy
  - Resolves: rhbz#2195919 - sssd-be tends to run out of system resources, hitting the maximum number of open files
  - Resolves: rhbz#2192708 - [RHEL8] [sssd] User lookup on IPA client fails with 's2n get_fqlist request failed'
  - Resolves: rhbz#2139467 - [RHEL8] sssd attempts LDAP password modify extended op after BIND failure
  - Resolves: rhbz#2054825 - sssd_be segfault at 0 ip 00007f16b5fcab7e sp 00007fffc1cc0988 error 4 in libc-2.28.so[7f16b5e72000+1bc000]
  - Resolves: rhbz#2189583 - [sssd] RHEL 8.9 Tier 0 Localization
  - Resolves: rhbz#2170720 - [RHEL8] When adding attributes in sssd.conf that we have already, the cross-forest query just stop working
  - Resolves: rhbz#2096183 - BE_REQ_USER_AND_GROUP LDAP search filter can inadvertently catch multiple overrides
  - Resolves: rhbz#2151450 - [RHEL8] SSSD missing group membership when evaluating GPO policy with 'auto_private_groups = true'


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 2.9.1-3
changelog:
  - Resolves: rhbz#2236414 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237302 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Eduardo Lima (Etrunko) <etrunko@redhat.com> - 2.9.1-4
changelog:
  - Related: rhbz#2236414 - dbus and crond getting terminated with SIGBUS in sss_client code
    Handle all invalidations consistently
    Supply a valid pointer to `sss_mmap_cache_validate_or_reinit()`, not a pointer to a local var


author: Darren Archibald <darren.archibald@oracle.com> - 2.9.1-4.0.1.5
changelog:
  - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest (JIRA:RHEL-19212)
  - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users (JIRA:RHEL-19994)
  - SSSD GPO lacks group resolution on hosts (JIRA:RHEL-21085)
  - Make sure 8.9.z/9.3.z doesn't build 'passkey' code (JIRA:RHEL-21164)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.2-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: rhbz#2226021 - dbus and crond getting terminated with SIGBUS in sss_client code
  - Resolves: rhbz#2237253 - SSSD runs multiples lookup search for each NFS request (SBUS req chaining stopped working in sssd-2.7)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.3-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-14070 - sssd-2.9.2-1.el8 breaks smart card authentication
  - Resolves: RHEL-3665 - Unexplainable error "Unable to find primary gid [2]: No such file or directory" when SSSD performs lookup for an AD user


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-1
changelog:
  - Resolves: RHEL-2630 - Rebase SSSD for RHEL 8.10
  - Resolves: RHEL-1680 - auto_private_groups does not create cache in IPA server SSSD cache
  - Resolves: RHEL-10092 - logfile rotation for sssd_kcm not working properly, sssd_kcm never receives a 'kill -HUP'
  - Resolves: RHEL-17495 - New sssd.conf seems not to be backwards compatible (wrt SmartCard auth of local users using 'files provider')
  - Resolves: RHEL-18431 - Excessive logging to sssd_nss and sssd_be in multi-domain AD forest
  - Resolves: RHEL-5033 - Incorrect IdM product name in man sssd.conf
  - Resolves: RHEL-15368 - SSSD GPO lacks group resolution on hosts [rhel-8]
  - Resolves: RHEL-10721 - very bad performance when requesting service tickets
  - Resolves: RHEL-19011 - Invalid handling groups from child domain
  - Resolves: RHEL-19949 - latest sssd breaks logging in via XDMCP for LDAP/Kerberos users [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-2
changelog:
  - Resolves: RHEL-25064 - AD users are unable to log in due to case sensitivity of user because the domain is found as an alias to the email address. [rhel-8]
  - Resolves: RHEL-25066 - gdm smartcard login fails with sssd-2.9.3 in case of multiple identities [rhel-8]
  - Resolves: RHEL-25065 - ssh pubkey stored in ldap/AD no longer works to authenticate via sssd [rhel-8]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-3
changelog:
  - Resolves: RHEL-27205 - Race condition during authorization leads to GPO policies functioning inconsistently


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.1
changelog:
  - Resolves: RHEL-67671 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-8.10.z]
  - Resolves: RHEL-68507 - sssd backend process segfaults when krb5.conf is invalid [rhel-8.10.z]
  - Resolves: RHEL-66267 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-8.10.z]
  - Resolves: RHEL-67128 - Excessive "Domain not found' messages logged to sssd_nss & sssd_be in multidomain AD forest [rhel-8.10.z]
  - Resolves: RHEL-66272 - sssd is skipping GPO evaluation with auto_private_groups [rhel-8.10.z]
  - Resolves: RHEL-66277 - possible regression of rhbz#2196521 [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.2
changelog:
  - Resolves: RHEL-78300 - 'sssd_kcm' leaks memory [rhel-8.10.z]
  - Resolves: RHEL-82420 - Disk cache failure with large db sizes [rhel-8.10.z]
  - Resolves: RHEL-76022 - Use the DN from existing entry when updating a cached group [rhel-8.10.z]


author: EL Errata <el-errata_ww@oracle.com> - 2.9.4-5.0.2.2
changelog:
  - Missing ntohs to service port [Orabug: 37389651]
  - Restore default debug level for sss_cache [Orabug: 32810448]


author: Alejandro López <allopez@redhat.com> - 2.9.4-5.3
changelog:
  - Resolves: RHEL-112455 - p11_child currently has an infinite timeout [rhel-8.10.z]
  - Resolves: RHEL-120292 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-8.10.z]


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.4-5.4
changelog:
  - Resolves: RHEL-143731 - Crash in 'sss_client/autofs/sss_autofs.c' [rhel-8.10.z]
  - Resolves: RHEL-133476 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name [rhel-8.10.z]
  - Resolves: RHEL-114350 - Frequent crashes of the SSSD process (sssd_pac), leading to the termination of the AD trusted domain subprocess by the watchdog [rhel-8.10.z]
  - Resolves: RHEL-143719 - SSSD unable to enumerate LDAP groups with 'getent group' & 'getent group -s sss ' if LDAP server contains any group with # character in their names [rhel-8.10.z]


author: Tony Asleson <tasleson@redhat.com> - 1.9.1-7
changelog:
  - Remove valgrind dependency as not being used and causing
    build to fail as it pulls in python3.11


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.14-1
changelog:
  - New upstream release - 2.1.14
  - Patch the waf script to explicitly call python2 as "env python" doesn't
    yield py2 anymore


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-1
changelog:
  - Resolves: rhbz#1684577 - Rebase libtalloc to version 2.1.16 for Samba
  - Resolves: rhbz#1597315 - libtalloc uses Python 2 to build
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-2
changelog:
  - Remove python2 libraries on upgrade
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 2.1.16-3
changelog:
  - Also obsolete python2-libtalloc-debuginfo
  - Resolves: rhbz#1567136 - libtalloc: Drop Python 2 subpackage from RHEL 8


author: Daiki Ueno <dueno@redhat.com> - 0.1.24-1
changelog:
  - Update to 0.1.24
  - Apply patch from upstream, which fixes scim-thai FTBFS with GCC6 (Closes: #1308117)


author: Nikola Forró <nforro@redhat.com> - 4.0.9-19
changelog:
  - Fix CVE-2020-35521 (#1945539)
  - Fix CVE-2020-35522 (#1945555)
  - Fix CVE-2020-35523 (#1945542)
  - Fix CVE-2020-35524 (#1945546)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-23
changelog:
  - Fix various CVEs
  - Resolves: CVE-2022-0561 CVE-2022-0562 CVE-2022-22844 CVE-2022-0865
    CVE-2022-0891 CVE-2022-0924 CVE-2022-0909 CVE-2022-0908 CVE-2022-1355


author: Darren Archibald <darren.archibald@oracle.com> - 4.0.9-29
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
  - Resolves: (BZ#2170167) (BZ#2170172) (BZ#2170178) (BZ#2170187) (BZ#2170192)


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-29
changelog:
  - Fix CVE-2023-0800 CVE-2023-0801 CVE-2023-0802 CVE-2023-0803 CVE-2023-0804
  - Resolves: RHEL-4683 RHEL-4685 RHEL-4686 RHEL-4687 RHEL-4688


author: Ondrej Sloup <osloup@redhat.com> - 4.0.9-30
changelog:
  - Bump specfile to retrigger gating
  - Add tests folder for standard beakerlib
  - Related: RHEL-4683 RHEL-4685 RHEL-4686 RHEL-4687 RHEL-4688


author: Matej Mužila <mmuzila@redhat.com> - 4.0.9-32
changelog:
  - Fix CVE-2023-6228 CVE-2023-52356 CVE-2023-25433 CVE-2018-15209
  - Resolves: RHEL-30682 RHEL-30520 RHEL-30474 RHEL-5406


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-14
changelog:
  - iscsi: CHAP auth algorithm selection fixes (#2188991)
  - tests: Use stronger passphrases for LUKS tests
  - lvm2: Improve uevent processing (#2039772)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.9.0-16
changelog:
  - iscsi: Fix login on firmware-discovered nodes (#2213193)
  - tests: Extend iscsi method call timeouts (#2213715)


author: Tomas Bzatek <tbzatek@redhat.com> - 2.8.3-1
changelog:
  - Rebased to upstream 2.8.3 release (#1685210)
  - Fix leaking filedescriptors (#1614774)
  - Fix udisksctl pager scrolling (#1662336)
  - Fix LVM2 plugin CreateSnapshot() error (#1668291)
  - Add ISCSI plugin GetInitiatorNameRaw() method (#1710257)


author: Robert Scheck <robert@fedoraproject.org> 0.9.12-15
changelog:
  - Added patch to avoid a /usr/@DATADIRNAME@/locale/ directory
  - Use %{_udevrulesdir} macro rather /etc/udev/rules.d/ (#1226681)


author: Jeff Moyer <jmoyer@redhat.com> - 1.0.7-2.el8
changelog:
  - Fix versioning.  The installed library is 1.0.7, make the rpm match.
  - bump release number for build, which includes -fPIC fix
  - Related: rhbz#1862551


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-14
changelog:
  - Do not build python2-libuser at all in RHEL-8
  - Resolves: #1559103 - libuser: Drop Python 2 subpackage(s) from RHEL 8


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-16
changelog:
  - Use 2048bit keys in tests
  - Resolves: rhbz#1611729 - [RHEL8-S-BUILD] libuser Fails Scratch Build on rhel-8.0


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-17
changelog:
  - Resolves: rhbz#1558151 - libuser needs audit events around the account
                             lifecycle


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-19
changelog:
  - Resolves: rhbz#1602600 -  Please review important issues found by covscan
                              in "libuser-0.62-14.el8+7" package


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-20
changelog:
  - Resolves: rhbz#1637398 - libuser-python3 should be renamed to comply
                             with Packaging Guidelines


author: Jakub Hrozek <jhrozek@redhat.com> - 0.62-23
changelog:
  - Actually apply the patch from the previous build
  - Resolves: rhbz#1670997 - Amend the user lifecycle auditing


author: Michal Hlavinka <mhlavink@redhat.com> - 0.62-26
changelog:
  - fix findings from static application security testing (#RHEL-35578)
  - translation update (#RHEL-12111)


author: Miroslav Lichvar <mlichvar@redhat.com> - 1.1.6-14
changelog:
  - build with hardening LDFLAGS (#1548717)
  - remove obsolete macro and comments
  - add gcc to build requirements


author: Harald Hoyer <harald@redhat.com> - 16-1
changelog:
  - libvarlink 16
  - fixed coverity issues
  - Resolves: #1638294 - Interface name validation rule update


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-16
changelog:
  - util: Don't overflow in virRandomBits (rhbz#1655586)
  - virrandom: Avoid undefined behaviour in virRandomBits (rhbz#1655586)
  - spec: remove libcgroup and cgconfig (rhbz#1602407)
  - qemu: Drop duplicated code from qemuDomainDefValidateFeatures() (rhbz#1647822)
  - tests: Add capabilities data for QEMU 3.1.0 on ppc64 (rhbz#1647822)
  - qemu: Introduce QEMU_CAPS_MACHINE_PSERIES_CAP_NESTED_HV (rhbz#1647822)
  - conf: Parse and format nested-hv feature (rhbz#1647822)
  - qemu: Format nested-hv feature on the command line (rhbz#1647822)
  - qemu: Add check for whether KVM nesting is enabled (rhbz#1645139)
  - secret: Add check/validation for correct usage when LookupByUUID (rhbz#1656255)
  - cpu: Add support for "stibp" x86_64 feature (rhbz#1655032)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-17
changelog:
  - virsh: Strip XML declaration when extracting CPU XMLs (rhbz#1659048)
  - RHEL: qemu: Add ability to set sgio values for hostdev (rhbz#1582424)
  - RHEL: qemu: Add check for unpriv sgio for SCSI generic host device (rhbz#1582424)
  - qemu: Alter @val usage in qemuSetUnprivSGIO (rhbz#1656362)
  - qemu: Alter qemuSetUnprivSGIO hostdev shareable logic (rhbz#1656362)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-18
changelog:
  - conf: correct false boot order error during domain parse (rhbz#1630393)
  - qemu: Remove duplicated qemuAgentCheckError (rhbz#1665000)
  - qemu: require reply from guest agent in qemuAgentGetInterfaces (rhbz#1665000)
  - qemu: Filter non SCSI hostdevs in qemuHostdevPrepareSCSIDevices (rhbz#1665244)
  - util: remove const specifier from nlmsghdr arg to virNetlinkDumpCallback() (rhbz#1583131)
  - util: add a function to insert new interfaces to IPv6CheckForwarding list (rhbz#1583131)
  - util: use nlmsg_find_attr() instead of an open-coded loop (rhbz#1583131)
  - util: check accept_ra for all nexthop interfaces of multipath routes (rhbz#1583131)
  - util: make forgotten changes suggested during review of commit d40b820c (rhbz#1583131)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-19
changelog:
  - qemu: Fix logic error in qemuSetUnprivSGIO (rhbz#1666605)
  - tests: qemuxml2argv: Add test case for empty CDROM with cache mode (rhbz#1553255)
  - qemu: command: Don't format image properties for empty -drive (rhbz#1553255)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-21
changelog:
  - docs: Drop /dev/net/tun from the list of shared devices (rhbz#1665400)
  - qemu: conf: Remove /dev/sev from the default cgroup device acl list (rhbz#1665400)
  - qemu: cgroup: Expose /dev/sev/ only to domains that require SEV (rhbz#1665400)
  - qemu: domain: Add /dev/sev into the domain mount namespace selectively (rhbz#1665400)
  - security: dac: Relabel /dev/sev in the namespace (rhbz#1665400)
  - qemu: caps: Use CAP_DAC_OVERRIDE for probing to avoid permission issues (rhbz#1665400)
  - qemu: caps: Don't try to ask for CAP_DAC_OVERRIDE if non-root (rhbz#1665400)
  - Revert "RHEL: Require firewalld-filesystem for firewalld rpm macros" (rhbz#1650320)
  - Revert "RHEL: network: regain guest network connectivity after firewalld switch to nftables" (rhbz#1650320)
  - configure: change HAVE_FIREWALLD to WITH_FIREWALLD (rhbz#1650320)
  - util: move all firewalld-specific stuff into its own files (rhbz#1650320)
  - util: new virFirewallD APIs + docs (rhbz#1650320)
  - configure: selectively install a firewalld 'libvirt' zone (rhbz#1650320)
  - network: set firewalld zone of bridges to "libvirt" zone when appropriate (rhbz#1650320)
  - network: allow configuring firewalld zone for virtual network bridge device (rhbz#1650320)
  - util: remove test code accidentally committed to virFirewallDZoneExists (rhbz#1650320)
  - qemu: command: Don't skip 'readonly' and throttling info for empty drive (rhbz#1670337)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-24
changelog:
  - tests: qemuxml2argv: add CAPS_ARCH_LATEST macro (rhbz#1698855)
  - qemu: Add ccw support for vhost-vsock (rhbz#1698855)
  - qemu: Allow creating ppc64 guests with graphics and no USB mouse (rhbz#1683681)
  - conf: Expose virDomainSCSIDriveAddressIsUsed (rhbz#1692354)
  - qemuhotplugtest: Don't plug a SCSI disk at unit 7 (rhbz#1692354)
  - qemu_hotplug: Check for duplicate drive addresses (rhbz#1692354)
  - cpu_map: Add support for cldemote CPU feature (rhbz#1537731)
  - util: alloc: add macros for implementing automatic cleanup functionality (rhbz#1505998)
  - qemu: domain: Simplify non-VFIO memLockLimit calculation for PPC64 (rhbz#1505998)
  - qemu_domain: add a PPC64 memLockLimit helper (rhbz#1505998)
  - qemu_domain: NVLink2 bridge detection function for PPC64 (rhbz#1505998)
  - PPC64 support for NVIDIA V100 GPU with NVLink2 passthrough (rhbz#1505998)
  - cpu_x86: Do not cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - qemu: Don't cache microcode version (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - cputest: Add data for Intel(R) Xeon(R) CPU E3-1225 v5 (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)
  - cpu_map: Define md-clear CPUID bit (CVE-2018-12127, CVE-2019-11091, CVE-2018-12126, CVE-2018-12130)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-29
changelog:
  - cpu: allow include files for CPU definition (rhbz#1686895)
  - cpu: fix cleanup when signature parsing fails (rhbz#1686895)
  - cpu: push more parsing logic into common code (rhbz#1686895)
  - cpu: simplify failure cleanup paths (rhbz#1686895)
  - cpu_map: Add support for arch-capabilities feature (rhbz#1693433)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2630 v4 (rhbz#1686895)
  - cputest: Add data for Intel(R) Core(TM) i7-7600U (rhbz#1686895)
  - cputest: Add data for Intel(R) Xeon(R) CPU E7540 (rhbz#1686895)
  - cputest: Add data for Intel(R) Xeon(R) CPU E5-2650 (rhbz#1686895)
  - cputest: Add data for Intel(R) Core(TM) i7-8700 (rhbz#1686895)
  - cpu_x86: Separate ancestor model parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate signature parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate vendor parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Separate feature list parsing from x86ModelParse (rhbz#1686895)
  - cpu_x86: Make sure CPU model names are unique in cpu_map (rhbz#1686895)
  - cpu_x86: Add x86ModelCopySignatures helper (rhbz#1686895)
  - cpu_x86: Store CPU signature in an array (rhbz#1686895)
  - cpu_x86: Allow multiple signatures for a CPU model (rhbz#1686895)
  - cpu_x86: Log decoded CPU model and signatures (rhbz#1686895)
  - qemu_capabilities: Inroduce virQEMUCapsGetCPUModelX86Data (rhbz#1686895)
  - qemu_capabilities: Introduce virQEMUCapsGetCPUModelInfo (rhbz#1686895)
  - qemu_capabilities: Use virQEMUCapsGetCPUModelInfo (rhbz#1686895)
  - cpu_x86: Add virCPUx86DataGetSignature for tests (rhbz#1686895)
  - cpu_map: Add hex representation of signatures (rhbz#1686895)
  - cputest: Test CPU signatures (rhbz#1686895)
  - cpu_map: Add more signatures for Conroe CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for Penryn CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for Nehalem CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Westmere CPU model (rhbz#1686895)
  - cpu_map: Add more signatures for SandyBridge CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for IvyBridge CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Haswell CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Broadwell CPU models (rhbz#1686895)
  - cpu_map: Add more signatures for Skylake-Client CPU models (rhbz#1686895)
  - cpu: Don't access invalid memory in virCPUx86Translate (rhbz#1686895)
  - cpu_x86: Require <cpuid> within <feature> in CPU map (rhbz#1697627)
  - cputest: Add data for Intel(R) Xeon(R) Platinum 8268 CPU (rhbz#1693433)
  - cpu_map: Add Cascadelake-Server CPU model (rhbz#1693433)
  - cpu_x86: Introduce virCPUx86DataItem container struct (rhbz#1697627)
  - cpu_x86: Rename virCPUx86Vendor.cpuid (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataItem variables (rhbz#1697627)
  - cpu_x86: Rename x86DataCpuidNext function (rhbz#1697627)
  - cpu_x86: Rename x86DataCpuid (rhbz#1697627)
  - cpu_x86: Rename virCPUx86CPUIDSorter (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataAddCPUIDInt (rhbz#1697627)
  - cpu_x86: Rename virCPUx86DataAddCPUID (rhbz#1697627)
  - cpu_x86: Rename virCPUx86VendorToCPUID (rhbz#1697627)
  - cpu_x86: Simplify x86DataAdd (rhbz#1697627)
  - cpu_x86: Introduce virCPUx86DataCmp (rhbz#1697627)
  - cpu_x86: Make x86cpuidSetBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidClearBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidAndBits more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidMatchMasked more general (rhbz#1697627)
  - cpu_x86: Make x86cpuidMatch more general (rhbz#1697627)
  - cpu_x86: Store virCPUx86DataItem content in union (rhbz#1697627)
  - cpu_x86: Add support for storing MSR features in CPU map (rhbz#1697627)
  - cpu_x86: Move *CheckFeature functions (rhbz#1697627)
  - cputest: Add support for MSR features to cpu-parse.sh (rhbz#1697627)
  - util: file: introduce VIR_AUTOCLOSE macro to close fd of the file automatically (rhbz#1697627)
  - vircpuhost: Add support for reading MSRs (rhbz#1697627)
  - virhostcpu: Make virHostCPUGetMSR() work only on x86 (rhbz#1697627)
  - cpu_x86: Fix placement of *CheckFeature functions (rhbz#1697627)
  - cpu_conf: Introduce virCPUDefFilterFeatures (rhbz#1697627)
  - qemu_command: Use consistent syntax for CPU features (rhbz#1697627)
  - tests: Add QEMU caps data for future 4.1.0 (rhbz#1697627)
  - tests: Add domain capabilities case for QEMU 4.1.0 (rhbz#1697627)
  - qemuxml2argvtest: Add test for CPU features translation (rhbz#1697627)
  - qemu: Add APIs for translating CPU features (rhbz#1697627)
  - qemu: Probe for max-x86_64-cpu type (rhbz#1697627)
  - qemu: Probe for "unavailable-features" CPU property (rhbz#1697627)
  - qemu: Probe host CPU after capabilities (rhbz#1697627)
  - qemu_command: Use canonical names of CPU features (rhbz#1697627)
  - qemu: Translate feature names from query-cpu-model-expansion (rhbz#1697627)
  - qemu: Don't use full CPU model expansion (rhbz#1697627)
  - qemu: Make qemuMonitorGetGuestCPU usable on x86 only (rhbz#1697627)
  - cpu: Introduce virCPUDataAddFeature (rhbz#1697627)
  - qemu: Add type filter to qemuMonitorJSONParsePropsList (rhbz#1697627)
  - util: string: Introduce macro for automatic string lists (rhbz#1697627)
  - util: json: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1697627)
  - qemu: Introduce generic qemuMonitorGetGuestCPU (rhbz#1697627)
  - qemu_process: Prefer generic qemuMonitorGetGuestCPU (rhbz#1697627)
  - util: Rework virStringListAdd (rhbz#1697627)
  - conf: Introduce virCPUDefCheckFeatures (rhbz#1697627)
  - cpu_x86: Turn virCPUx86DataIteratorInit into a function (rhbz#1697627)
  - cpu_x86: Introduce virCPUx86FeatureFilter*MSR (rhbz#1697627)
  - cpu_x86: Read CPU features from IA32_ARCH_CAPABILITIES MSR (rhbz#1697627)
  - cpu_map: Introduce IA32_ARCH_CAPABILITIES MSR features (rhbz#1697627)
  - qemu: Forbid MSR features with old QEMU (rhbz#1697627)
  - qemu: Drop MSR features from host-model with old QEMU (rhbz#1697627)
  - cpu_x86: Fix memory leak - virCPUx86GetHost (rhbz#1697627)
  - qemu: Use @tmpChr in qemuDomainDetachChrDevice to build device string (rhbz#1624204)
  - qemu: Drop "user-" prefix for guestfwd netdev (rhbz#1624204)
  - qemu_hotplug: Attach guestfwd using netdev_add (rhbz#1624204)
  - qemu_hotplug: Detach guestfwd using netdev_del (rhbz#1624204)
  - qemuhotplugtest: Test guestfwd attach and detach (rhbz#1624204)
  - daemon: Register secret driver before storage driver (rhbz#1685151)
  - bhyve: Move autostarting of domains into bhyveStateInitialize (rhbz#1685151)
  - Revert "virStateDriver - Separate AutoStart from Initialize" (rhbz#1685151)
  - Revert "Separate out StateAutoStart from StateInitialize" (rhbz#1685151)
  - util: moving 'type' argument to avoid issues with mount() syscall. (rhbz#1689297)
  - util: cgroup: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1689297)
  - vircgroup: Rename structs to start with underscore (rhbz#1689297)
  - vircgroup: Introduce standard set of typedefs and use them (rhbz#1689297)
  - vircgroup: Extract file link resolving into separate function (rhbz#1689297)
  - vircgroup: Remove unused function virCgroupKill() (rhbz#1689297)
  - vircgroup: Unexport unused function virCgroupAddTaskController() (rhbz#1689297)
  - vircgroup: Unexport unused function virCgroupRemoveRecursively (rhbz#1689297)
  - vircgroup: Move function used in tests into vircgrouppriv.h (rhbz#1689297)
  - vircgroup: Remove pointless bool parameter (rhbz#1689297)
  - vircgroup: Extract mount options matching into function (rhbz#1689297)
  - vircgroup: Use virCgroupMountOptsMatchController in virCgroupDetectPlacement (rhbz#1689297)
  - vircgroup: Introduce virCgroupEnableMissingControllers (rhbz#1689297)
  - vircgroup: machinename will never be NULL (rhbz#1689297)
  - vircgroup: Remove virCgroupAddTaskController (rhbz#1689297)
  - vircgroup: Introduce virCgroupGetMemoryStat (rhbz#1689297)
  - lxc: Use virCgroupGetMemoryStat (rhbz#1689297)
  - vircgroup: fix MinGW build (rhbz#1689297)
  - vircgroup: Duplicate string before modifying (rhbz#1689297)
  - vircgroup: Extract controller detection into function (rhbz#1689297)
  - vircgroup: Extract placement validation into function (rhbz#1689297)
  - vircgroup: Split virCgroupPathOfController into two functions (rhbz#1689297)
  - vircgroup: Call virCgroupRemove inside virCgroupMakeGroup (rhbz#1689297)
  - vircgroup: Simplify if conditions in virCgroupMakeGroup (rhbz#1689297)
  - vircgroup: Remove obsolete sa_assert (rhbz#1689297)
  - tests: Resolve possible overrun (rhbz#1689297)
  - vircgroup: cleanup controllers not managed by systemd on error (rhbz#1689297)
  - vircgroup: fix bug in virCgroupEnableMissingControllers (rhbz#1689297)
  - vircgroup: rename virCgroupAdd.*Task to virCgroupAdd.*Process (rhbz#1689297)
  - vircgroup: introduce virCgroupTaskFlags (rhbz#1689297)
  - vircgroup: introduce virCgroupAddThread (rhbz#1689297)
  - vircgroupmock: cleanup unused cgroup files (rhbz#1689297)
  - vircgroupmock: rewrite cgroup fopen mocking (rhbz#1689297)
  - vircgrouptest: call virCgroupDetectMounts directly (rhbz#1689297)
  - vircgrouptest: call virCgroupNewSelf instead virCgroupDetectMounts (rhbz#1689297)
  - util: introduce vircgroupbackend files (rhbz#1689297)
  - vircgroup: introduce cgroup v1 backend files (rhbz#1689297)
  - vircgroup: extract virCgroupV1Available (rhbz#1689297)
  - vircgroup: detect available backend for cgroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1ValidateMachineGroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1CopyMounts (rhbz#1689297)
  - vircgroup: extract v1 detect functions (rhbz#1689297)
  - vircgroup: extract virCgroupV1CopyPlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1ValidatePlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1StealPlacement (rhbz#1689297)
  - vircgroup: extract virCgroupV1DetectControllers (rhbz#1689297)
  - vircgroup: extract virCgroupV1HasController (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetAnyController (rhbz#1689297)
  - vircgroup: extract virCgroupV1PathOfController (rhbz#1689297)
  - vircgroup: extract virCgroupV1MakeGroup (rhbz#1689297)
  - vircgroup: extract virCgroupV1Remove (rhbz#1689297)
  - vircgroup: extract virCgroupV1AddTask (rhbz#1689297)
  - vircgroup: extract virCgroupV1HasEmptyTasks (rhbz#1689297)
  - vircgroup: extract virCgroupV1BindMount (rhbz#1689297)
  - vircgroup: extract virCgroupV1SetOwner (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioWeight (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetBlkioIoServiced (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetBlkioIoDeviceServiced (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWeight (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceReadIops (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWriteIops (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceReadBps (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)BlkioDeviceWriteBps (rhbz#1689297)
  - vircgroup: extract virCgroupV1SetMemory (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemoryStat (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemoryUsage (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)Memory*Limit (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetMemSwapUsage (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Allow|Deny)Device (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Allow|Deny)AllDevices (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuShares (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuCfsPeriod (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpuCfsQuota (rhbz#1689297)
  - vircgroup: extract virCgroupV1SupportsCpuBW (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetCpuacct*Usage (rhbz#1689297)
  - vircgroup: extract virCgroupV1GetCpuacctStat (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)FreezerState (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetMems (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetMemoryMigrate (rhbz#1689297)
  - vircgroup: extract virCgroupV1(Set|Get)CpusetCpus (rhbz#1689297)
  - vircgroup: rename virCgroupController into virCgroupV1Controller (rhbz#1689297)
  - vircgroup: rename controllers to legacy (rhbz#1689297)
  - vircgroup: remove VIR_CGROUP_SUPPORTED (rhbz#1689297)
  - vircgroup: include system headers only on linux (rhbz#1689297)
  - vircgroupv1: fix build on non-linux OSes (rhbz#1689297)
  - Revert "vircgroup: cleanup controllers not managed by systemd on error" (rhbz#1689297)
  - util: introduce cgroup v2 files (rhbz#1689297)
  - vircgroup: introduce virCgroupV2Available (rhbz#1689297)
  - vircgroup: introduce virCgroupV2ValidateMachineGroup (rhbz#1689297)
  - vircgroup: introduce virCgroupV2CopyMounts (rhbz#1689297)
  - vircgroup: introduce virCgroupV2CopyPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectMounts (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2ValidatePlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2StealPlacement (rhbz#1689297)
  - vircgroup: introduce virCgroupV2DetectControllers (rhbz#1689297)
  - vircgroup: introduce virCgroupV2HasController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetAnyController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2PathOfController (rhbz#1689297)
  - vircgroup: introduce virCgroupV2MakeGroup (rhbz#1689297)
  - vircgroup: introduce virCgroupV2Remove (rhbz#1689297)
  - vircgroup: introduce virCgroupV2AddTask (rhbz#1689297)
  - vircgroup: introduce virCgroupV2HasEmptyTasks (rhbz#1689297)
  - vircgroup: introduce virCgroupV2BindMount (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SetOwner (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioWeight (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetBlkioIoServiced (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetBlkioIoDeviceServiced (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWeight (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadIops (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteIops (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceReadBps (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)BlkioDeviceWriteBps (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SetMemory (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemoryStat (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemoryUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemoryHardLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemorySoftLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)MemSwapHardLimit (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetMemSwapUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuShares (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuCfsPeriod (rhbz#1689297)
  - vircgroup: introduce virCgroupV2(Set|Get)CpuCfsQuota (rhbz#1689297)
  - vircgroup: introduce virCgroupV2SupportsCpuBW (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetCpuacctUsage (rhbz#1689297)
  - vircgroup: introduce virCgroupV2GetCpuacctStat (rhbz#1689297)
  - vircgroup: register cgroup v2 backend (rhbz#1689297)
  - vircgroup: add support for hybrid configuration (rhbz#1689297)
  - vircgroupmock: change cgroup prefix (rhbz#1689297)
  - vircgroupmock: add support to test cgroup v2 (rhbz#1689297)
  - vircgrouptest: introduce initFakeFS and cleanupFakeFS helpers (rhbz#1689297)
  - vircgrouptest: prepare testCgroupDetectMounts for cgroup v2 (rhbz#1689297)
  - vircgrouptest: add detect mounts test for cgroup v2 (rhbz#1689297)
  - vircgrouptest: add detect mounts test for hybrid cgroups (rhbz#1689297)
  - vircgrouptest: prepare validateCgroup for cgroupv2 (rhbz#1689297)
  - vircgrouptest: add cgroup v2 tests (rhbz#1689297)
  - vircgrouptest: add hybrid tests (rhbz#1689297)
  - virt-host-validate: rewrite cgroup detection to use util/vircgroup (rhbz#1689297)
  - virt-host-validate: require freezer for LXC (rhbz#1689297)
  - virt-host-validate: Fix build on non-Linux (rhbz#1689297)
  - tests: Use correct function name in error path (rhbz#1689297)
  - util: Fix virCgroupGetMemoryStat (rhbz#1689297)
  - tests: Augment vcgrouptest to add virCgroupGetMemoryStat (rhbz#1689297)
  - vircgroup: introduce virCgroupKillRecursiveCB (rhbz#1689297)
  - vircgroupv2: fix virCgroupV2ValidateMachineGroup (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetMems (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetMemoryMigrate (rhbz#1689297)
  - util: implement virCgroupV2(Set|Get)CpusetCpus (rhbz#1689297)
  - util: enable cgroups v2 cpuset controller for threads (rhbz#1689297)
  - util: vircgroup: pass parent cgroup into virCgroupDetectControllersCB (rhbz#1689297)
  - internal: introduce a family of NULLSTR macros (rhbz#1689297)
  - util: vircgroup: improve controller detection (rhbz#1689297)
  - util: vircgroupv2: use any controller to create thread directory (rhbz#1689297)
  - util: vircgroupv2: enable CPU controller only if it's available (rhbz#1689297)
  - util: vircgroupv2: separate return values of virCgroupV2EnableController (rhbz#1689297)
  - util: vircgroupv2: don't error out if enabling controller fails (rhbz#1689297)
  - util: vircgroupv2: mark only requested controllers as available (rhbz#1689297)
  - Revert "util: vircgroup: pass parent cgroup into virCgroupDetectControllersCB" (rhbz#1689297)
  - util: vircgroupv2: stop enabling missing controllers with systemd (rhbz#1689297)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-30
changelog:
  - virWaitForDevices: Drop confusing part of comment (rhbz#1710575)
  - lib: Drop UDEVSETTLE (rhbz#1710575)
  - m4: Provide default value fore UDEVADM (rhbz#1710575)
  - m4: Drop needless string checks (rhbz#1710575)
  - util: vircgroup: introduce virCgroup(Get|Set)ValueRaw (rhbz#1658890)
  - util: vircgroup: move virCgroupGetValueStr out of virCgroupGetValueForBlkDev (rhbz#1658890)
  - util: vircgroupv1: add support for BFQ blkio files (rhbz#1658890)
  - util: vircgroupv2: add support for BFQ files (rhbz#1658890)
  - Handle copying bitmaps to larger data buffers (rhbz#1703160)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-31
changelog:
  - virDomainObjListAddLocked: fix double free (rhbz#1728530)
  - docs: schemas: Decouple the virtio options from each other (rhbz#1729675)
  - util: command: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1721434)
  - util: command: define cleanup function using VIR_DEFINE_AUTOPTR_FUNC (rhbz#1721434)
  - util: netdevopenvswitch: use VIR_AUTOFREE instead of VIR_FREE for scalar types (rhbz#1721434)
  - util: virnetdevopenvswitch: Drop an unused variable @ovs_timeout (rhbz#1721434)
  - util: netdevopenvswitch: use VIR_AUTOPTR for aggregate types (rhbz#1721434)
  - util: suppress unimportant ovs-vsctl errors when getting interface stats (rhbz#1721434)
  - virNetDevOpenvswitchInterfaceStats: Optimize for speed (rhbz#1721434)
  - test: Introduce virnetdevopenvswitchtest (rhbz#1721434)
  - vircommand: Separate mass FD closing into a function (rhbz#1721434)
  - virCommand: use procfs to learn opened FDs (rhbz#1721434)
  - util: command: Ignore bitmap errors when enumerating file descriptors to close (rhbz#1721434)
  - util: Avoid possible error in virCommandMassClose (rhbz#1721434)
  - vircgroup: fix cgroups v2 controllers detection (rhbz#1689297)
  - vircgroupv2: store enabled controllers (rhbz#1689297)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-32
changelog:
  - virDomainObjListAddLocked: Produce better error message than 'Duplicate key' (rhbz#1737790)
  - virdbus: Grab a ref as long as the while loop is executed (rhbz#1741900)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-33
changelog:
  - vircgroupv2: fix parsing multiple values in single file (rhbz#1741825)
  - vircgroupv2: fix virCgroupV2GetCpuCfsQuota for "max" value (rhbz#1741837)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35.1.el8
changelog:
  - cpu_conf: Pass policy to CPU feature filtering callbacks (rhbz#1775133, rhbz#1775134, rhbz#1775137)
  - qemuxml2*test: Add tests for Icelake-Server, -pconfig (rhbz#1775133, rhbz#1775134, rhbz#1775137)
  - qemu: Drop disabled CPU features unknown to QEMU (rhbz#1775133, rhbz#1775134, rhbz#1775137)
  - cputest: Add data for Ice Lake Server CPU (rhbz#1775133, rhbz#1775134, rhbz#1775137)
  - cpu_map: Drop pconfig from Icelake-Server CPU model (rhbz#1775133, rhbz#1775134, rhbz#1775137)
  - qemu: Fix NULL ptr dereference caused by qemuDomainDefFormatBufInternal (rhbz#1775133, rhbz#1775134, rhbz#1775137)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-35.2.el8
changelog:
  - cpu_map: Add TAA_NO bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)
  - cpu_map: Add TSX_CTRL bit for IA32_ARCH_CAPABILITIES MSR (CVE-2019-11135)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-36
changelog:
  - cpu_conf: Pass policy to CPU feature filtering callbacks (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemuxml2*test: Add tests for Icelake-Server, -pconfig (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemu: Drop disabled CPU features unknown to QEMU (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - cputest: Add data for Ice Lake Server CPU (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - cpu_map: Drop pconfig from Icelake-Server CPU model (rhbz#1749672, rhbz#1756156, rhbz#1721608)
  - qemu: Fix NULL ptr dereference caused by qemuDomainDefFormatBufInternal (rhbz#1749672, rhbz#1756156, rhbz#1721608)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-39
changelog:
  - selinux: Do not report an error when not returning -1 (rhbz#1788096)
  - qemu: Fix hyperv features with QEMU 4.1 (rhbz#1794868)
  - qemu: Prefer dashes for hyperv features (rhbz#1794868)
  - cpu: Drop KVM_ from hyperv feature macros (rhbz#1794868)
  - cpu: Drop unused KVM features (rhbz#1794868)
  - qemu: Fix KVM features with QEMU 4.1 (rhbz#1794868)
  - cpu: Drop CPUID definition for hv-spinlocks (rhbz#1794868)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-40
changelog:
  - process: wait longer on kill per assigned Hostdev (rhbz#1785338)
  - process: wait longer 5->30s on hard shutdown (rhbz#1785338)


author: Jiri Denemark <jdenemar@redhat.com> - 4.5.0-42
changelog:
  - RHEL: virscsi: Check device type before getting it's /dev node name (rhbz#1808388)
  - RHEL: virscsi: Support TAPEs in virSCSIDeviceGetDevName() (rhbz#1808388)
  - RHEL: virscsi: Introduce and use virSCSIDeviceGetUnprivSGIOSysfsPath() (rhbz#1808388)
  - RHEL: virutil: Accept non-block devices in virGetDeviceID() (rhbz#1808388)
  - RHEL: qemuSetUnprivSGIO: Actually use calculated @sysfs_path to set unpriv_sgio (rhbz#1808388)
  - RHEL: qemuCheckUnprivSGIO: use @sysfs_path to get unpriv_sgio (rhbz#1808399)


author: Jiri Denemark <jdenemar@redhat.com> - 6.0.0-25
changelog:
  - Upgrade components in virt:rhel module:stream for RHEL-8.3 release (rhbz#1828317)
  - conf: Don't format http cookies unless VIR_DOMAIN_DEF_FORMAT_SECURE is used (CVE-2020-14301)
  - util: Introduce a parser for kernel cmdline arguments (rhbz#1848997)
  - qemu: Check if s390 secure guest support is enabled (rhbz#1848997)
  - qemu: Check if AMD secure guest support is enabled (rhbz#1848997)
  - tools: Secure guest check on s390 in virt-host-validate (rhbz#1848997)
  - tools: Secure guest check for AMD in virt-host-validate (rhbz#1848997)
  - docs: Update AMD launch secure description (rhbz#1848997)
  - docs: Describe protected virtualization guest setup (rhbz#1848997)


