-
Tue Sep 29 2026 EL Errata <el-errata_ww@oracle.com> [6.12.0-211.61.1.el10_2]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
-
Mon Sep 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.61.1.el10_2]
- perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753}
- perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556}
- perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496]
- KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775}
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317}
- nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480}
- x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402]
- fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341}
- crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943]
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522}
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299}
- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661]
- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661]
- KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076}
- ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942}
-
Wed Sep 23 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.60.1.el10_2]
- pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121}
- nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481}
- af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005}
- af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262]
- af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262]
- ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714}
- drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108}
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257}
- drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266}
- drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098}
- drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311}
- drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311}
- drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273}
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290}
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230}
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204}
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199}
- powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331]
- powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331]
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285}
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116}
-
Tue Sep 22 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.59.1.el10_2]
- net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844}
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846}
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569}
- redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788]
- watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788]
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788]
- usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788]
- usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788]
- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788]
- rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788]
- i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788]
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788]
- i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788]
- i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788]
- i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788]
- gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788]
- gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788]
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788]
- gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788]
- gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788]
- gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788]
- selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243}
- smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383}
- RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007}
- block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638]
- block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053}
- blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802}
- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283]
- ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201}
- sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564}
- mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831}
- sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266}
- module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298]
-
Mon Sep 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.58.1.el10_2]
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964}
-
Mon Sep 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.57.1.el10_2]
- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534}
- mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518}
- redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517]
- arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517]
- pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517]
- pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517]
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517]
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
- libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
- Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188}
- libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155}
- redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478]
- redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478]
- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471]
- iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945}
- iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944}
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894}
- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391}
- net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293}
- dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062}
- crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959}
- keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823}
-
Wed Sep 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.56.1.el10_2]
- redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518]
- hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518]
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518]
- hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518]
- hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518]
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363}
- wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175}
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176}
- net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172}
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869}
- smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105]
- time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225]
- clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519]
- configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519]
- clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519]
- arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519]
- ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519]
- redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516]
- arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516]
- nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516]
- dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516]
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045}
- octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923}
- dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102}
- net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143}
- net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294}
- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776]
- ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128}
- ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200}
- netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414}
- net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971}
- ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192}
- ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029}
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456}
- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176}
- soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007}
-
Mon Sep 14 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.55.1.el10_2]
- arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890]
- arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890]
- iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890]
- iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890]
- iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890]
- iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890]
- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890]
- iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890]
- iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890]
- iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890]
- iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890]
- iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890]
- iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890]
- iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890]
- iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890]
- dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890]
- dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890]
- i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890]
- i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890]
- i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890]
- i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890]
- i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890]
- redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233]
- iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233]
- iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233]
- iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233]
- dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233]
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233]
- iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233]
- iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233]
- iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233]
- iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233]
- iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233]
- iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233]
- iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233]
- iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233]
- iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233]
- iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233]
- iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233]
- iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233]
- iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731]
- watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348]
- smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559]
- smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559]
- smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559]
- smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559]
- smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559]
- smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559]
- smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559]
- smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559]
- smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559]
- smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559]
- smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559]
- smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559]
- smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559]
- smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559]
- smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]
- smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559]
- smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559]
- smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559]
- smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559]
- smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]
- smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559]
- smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539}
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556}
- drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466}
- drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370}
- drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368}
- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656}
- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566}
- drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479}
- drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466}
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264}
- mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035]
- mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035]
- mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035]
- mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035]
- mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035]
- mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035]
- mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035]
- mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035]
- mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035]
- mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035]
- mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035]
- mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035]
- mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035]
- mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035]
- mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035]
- mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035]
- mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035]
- xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919}
- xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
- xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
- xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239}
- ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917}
- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921}
- af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361}
- af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394}
- af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544]
- af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544]
- af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544]
- af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544]
- af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544]
- af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544]
- af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544]
- af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544]
- af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544]
- af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544]
- af_unix: Sort headers. (Davide Caratti) [RHEL-227544]
- unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544]
- af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544]
- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194]
- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246}
- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745}
- lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149}
- netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131}
- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889}
- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149}
- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924}
- vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248}
-
Mon Sep 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.54.1.el10_2]
- net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246933] {CVE-2026-74480}
-
Mon Sep 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.53.1.el10_2]
- dm-verity: fix buffer overflow in FEC calculation (Benjamin Marzinski) [RHEL-244969] {CVE-2026-72098}
- nvmet-rdma: handle inline data with a nonzero offset (CKI Backport Bot) [RHEL-244928] {CVE-2026-72129}
- rtla/timerlat_top: Fix on-threshold actions firing on signal (Tomas Glozar) [RHEL-193027]
- rtla/timerlat: Exit top main loop on any non-zero wait_retval (Tomas Glozar) [RHEL-193027]
- wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-237706] {CVE-2026-68409}
- wifi: mt76: mt7925: drop TXRX_NOTIFY on non-mmio buses (Jose Ignacio Tornos Martinez) [RHEL-237681] {CVE-2026-68193}
- wifi: mt76: mt7925: fix crash in reset link replay (Jose Ignacio Tornos Martinez) [RHEL-237527] {CVE-2026-68307}
- wifi: iwlwifi: mld: validate sta_mask before ffs() in BA session handlers (Jose Ignacio Tornos Martinez) [RHEL-232015] {CVE-2026-64255}
- wifi: mac80211: capture fast-RX rate before mesh reuses skb->cb (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117}
- wifi: mac80211: fix missing RX bitrate update for mesh forwarding path (Jose Ignacio Tornos Martinez) [RHEL-231685] {CVE-2026-64117}
- wifi: iwlwifi: mld: fix TSO segmentation explosion when AMSDU is disabled (Jose Ignacio Tornos Martinez) [RHEL-230977] {CVE-2026-64037}
- wifi: nl80211: reject oversized EMA RNR lists (Jose Ignacio Tornos Martinez) [RHEL-230604] {CVE-2026-53182}
- net: qrtr: fix refcount saturation and potential UAF in qrtr_port_remove (Jose Ignacio Tornos Martinez) [RHEL-229725] {CVE-2026-52947}
- wifi: mac80211: fix multi-link element inheritance (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515}
- wifi: mac80211: fix MLE defragmentation (Jose Ignacio Tornos Martinez) [RHEL-227617] {CVE-2026-64515}
- Bluetooth: fix locking in hci_conn_request_evt() with HCI_PROTO_DEFER (CKI Backport Bot) [RHEL-232673] {CVE-2026-53072}
- accel/qaic: Add overflow check to remap_pfn_range during mmap (CKI Backport Bot) [RHEL-232178] {CVE-2026-64051}
- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (CKI Backport Bot) [RHEL-231067] {CVE-2026-63947}
- Bluetooth: virtio_bt: validate rx pkt_type header length (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123}
- Bluetooth: virtio_bt: clamp rx length before skb_put (CKI Backport Bot) [RHEL-230949] {CVE-2026-46123}
- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (CKI Backport Bot) [RHEL-230076] {CVE-2026-53209}
- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (CKI Backport Bot) [RHEL-230013] {CVE-2026-63944}
- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (CKI Backport Bot) [RHEL-228750] {CVE-2026-63975}
- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946}
- Bluetooth: ISO: fix UAF in iso_recv_frame (CKI Backport Bot) [RHEL-227911] {CVE-2026-63946}
- ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227889] {CVE-2026-64113}
- Bluetooth: SMP: force responder MITM requirements before building the pairing response (CKI Backport Bot) [RHEL-227532] {CVE-2026-43334}
- vfio/pci: Check BAR resources before exporting a DMABUF (CKI Backport Bot) [RHEL-227133] {CVE-2026-64042}
- security/keys: fix missed RCU read section on lookup (CKI Backport Bot) [RHEL-225690] {CVE-2026-64015}
- Bluetooth: RFCOMM: validate skb length in MCC handlers (CKI Backport Bot) [RHEL-225653] {CVE-2026-53254}
- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (CKI Backport Bot) [RHEL-225574] {CVE-2026-53256}
- Bluetooth: serialize accept_q access (CKI Backport Bot) [RHEL-225552] {CVE-2026-52918}
- xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188232] {CVE-2026-53091}
- vfio/pci: Clean up DMABUFs before disabling function (CKI Backport Bot) [RHEL-189549] {CVE-2026-53322}
- KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation (CKI Backport Bot) [RHEL-189468] {CVE-2026-43133}