-
Wed Oct 07 2026 EL Errata <el-errata_ww@oracle.com> [6.12.0-211.63.1.el10_2.OL10]
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985782]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Update module name for cryptographic module [Orabug: 37400433]
- Clean git history at setup stage
-
Mon Oct 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.63.1.el10_2]
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271653] {CVE-2026-93288}
- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction (Davide Caratti) [RHEL-231698] {CVE-2026-64024}
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232645] {CVE-2026-46275}
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269475] {CVE-2026-90227}
- nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270934] {CVE-2026-89972}
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270888]
- ipv6: ioam: refresh hdr pointer before ioam6_event() (Prasenjit Mukherjee) [RHEL-259773] {CVE-2026-64132}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270657] {CVE-2026-97417}
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (Pablo Alessandro Santos Hugen) [RHEL-259063] {CVE-2026-52972}
- wifi: iwlwifi: reduce encryption error message to debug level in FIPS mode (Filip Balluch) [RHEL-257457]
- wifi: iwlwifi: restore FIPS-disabled features with fips exception (Filip Balluch) [RHEL-257457]
- wifi: mac80211: allow keys to driver with fips exception (Filip Balluch) [RHEL-257457]
- crypto: fips: add rh_fips_exception kernel boot parameter and fips_allows() helper (Filip Balluch) [RHEL-257457]
- futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263469] {CVE-2026-90003}
- futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263469]
- futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263469] {CVE-2026-80775}
- futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263469] {CVE-2026-80778}
- futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263469] {CVE-2026-80758}
- futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263469] {CVE-2026-80776}
- futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263469] {CVE-2026-74658}
- futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263469]
- compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263469]
- ipvs: reload ip header after head reallocation (CKI Backport Bot) [RHEL-263870] {CVE-2026-68476}
- ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258672] {CVE-2026-80792}
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259369] {CVE-2026-63924}
- ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259404] {CVE-2026-63922}
- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231288] {CVE-2026-63984}
- ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225393] {CVE-2026-63920}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231359] {CVE-2026-64557}
- l2tp: use refcount_inc_not_zero in l2tp_session_get_by_ifname (Abhishek Rawal) [RHEL-227466] {CVE-2026-63918}
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230778] {CVE-2026-63992}
- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259564] {CVE-2026-63994}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-239729] {CVE-2026-68432}
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247005] {CVE-2026-72052}
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247054] {CVE-2026-63829}
- Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229761] {CVE-2026-53357}
- netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261255] {CVE-2026-72320}
- KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258155] {CVE-2026-80921}
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Move x2AVIC MSR interception helper to avic.c (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Add a helper to look up the max physical ID for AVIC (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- KVM: SVM: Limit AVIC physical max index based on configured max_vcpu_ids (CKI Backport Bot) [RHEL-254525] {CVE-2026-74516}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254392] {CVE-2026-74669}
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252430] {CVE-2026-72255}
- netfilter: x_tables: close dangling table module init race (Phil Sutter) [RHEL-243394]
- netfilter: ebtables: close dangling table module init race (Phil Sutter) [RHEL-243394]
- netfilter: ebtables: move to two-stage removal scheme (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: add and use xtables_unregister_table_exit (Phil Sutter) [RHEL-243394] {CVE-2026-64078}
- netfilter: x_tables: unregister the templates first (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: add and use xt_unregister_table_pre_exit (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: allocate hook ops while under mutex (Phil Sutter) [RHEL-243394]
- netfilter: x_tables: allow initial table replace without emitting audit log message (Phil Sutter) [RHEL-243394]
- netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250538] {CVE-2026-74746}
- packet: use consistent hard_header_len in TX_RING send path (Toke Høiland-Jørgensen) [RHEL-244537]
- packet: use consistent hard_header_len in non-ring send paths (Toke Høiland-Jørgensen) [RHEL-244537] {CVE-2026-74582}
- net: remove CAP_SYS_RAWIO zero-padding in dev_validate_header (Toke Høiland-Jørgensen) [RHEL-244537]
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232598] {CVE-2026-45856}
- netfilter: nf_conncount: increase the connection clean up limit to 64 (CKI Backport Bot) [RHEL-232220] {CVE-2026-45860}
- ipvs: clear the svc scheduler ptr early on edit (CKI Backport Bot) [RHEL-225996] {CVE-2026-53270}
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214949] {CVE-2026-63794}
-
Wed Sep 30 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.62.1.el10_2]
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257773] {CVE-2026-72099}
- net: mana: Fix TOCTOU double-fetch of hwc_msg_id from DMA buffer (CKI Backport Bot) [RHEL-230992] {CVE-2026-64034}
- gve: fix Rx queue stall on alloc failure (Michal Schmidt) [RHEL-219261]
- gve: fix header buffer corruption with header-split and HW-GRO (Michal Schmidt) [RHEL-219261]
- gve: Use generic power management (Michal Schmidt) [RHEL-219261]
- gve: add support for UDP GSO for DQO format (Michal Schmidt) [RHEL-219261]
- gve: Enable hw-gro by default if device supported (Michal Schmidt) [RHEL-219261]
- gve: pull network headers into skb linear part (Michal Schmidt) [RHEL-219261]
- gve: fix SW coalescing when hw-GRO is used (Michal Schmidt) [RHEL-219261]
- gve: Advertise NETIF_F_GRO_HW instead of NETIF_F_LRO (Michal Schmidt) [RHEL-219261]
- gve: Enable reading max ring size from the device in DQO-QPL mode (Michal Schmidt) [RHEL-219261]
- gve: Update QPL page registration logic (Michal Schmidt) [RHEL-219261]
- gve: fix incorrect buffer cleanup in gve_tx_clean_pending_packets for QPL (Michal Schmidt) [RHEL-219261]
- gve: Correct ethtool rx_dropped calculation (Michal Schmidt) [RHEL-219261]
- gve: Fix stats report corruption on queue count change (Michal Schmidt) [RHEL-219261]
- gve: fix probe failure if clock read fails (Michal Schmidt) [RHEL-219261]
- net: gve: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-219261]
- gve: defer interrupt enabling until NAPI registration (Michal Schmidt) [RHEL-219261]
- gve: Move gve_init_clock to after AQ CONFIGURE_DEVICE_RESOURCES call (Michal Schmidt) [RHEL-219261]
- gve: Fix race condition on tx->dropped_pkt update (Michal Schmidt) [RHEL-219261]
- gve: Add Rx HWTS metadata to AF_XDP ZC mode (Michal Schmidt) [RHEL-219261]
- gve: Prepare bpf_xdp_metadata_rx_timestamp support (Michal Schmidt) [RHEL-219261]
- gve: Wrap struct xdp_buff (Michal Schmidt) [RHEL-219261]
- gve: Move ptp_schedule_worker to gve_init_clock (Michal Schmidt) [RHEL-219261]
- gve: Default to max_rx_buffer_size for DQO if device supported (Michal Schmidt) [RHEL-219261]
- gve: Allow ethtool to configure rx_buf_len (Michal Schmidt) [RHEL-219261]
- gve: Use extack to log xdp config verification errors (Michal Schmidt) [RHEL-219261]
- gve: Decouple header split from RX buffer length (Michal Schmidt) [RHEL-219261]
- gve: Implement settime64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261]
- gve: Implement gettimex64 with -EOPNOTSUPP (Michal Schmidt) [RHEL-219261]
- gve: Consolidate and persist ethtool ring changes (Michal Schmidt) [RHEL-219261]
- gve: Check valid ts bit on RX descriptor before hw timestamping (Michal Schmidt) [RHEL-219261]
- gve: prevent ethtool ops after shutdown (Michal Schmidt) [RHEL-219261]
- gve: implement DQO RX datapath and control path for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261]
- gve: implement DQO TX datapath for AF_XDP zero-copy (Michal Schmidt) [RHEL-219261]
- gve: keep registry of zc xsk pools in netdev_priv (Michal Schmidt) [RHEL-219261]
- gve: merge xdp and xsk registration (Michal Schmidt) [RHEL-219261]
- gve: deduplicate xdp info and xsk pool registration logic (Michal Schmidt) [RHEL-219261]
- gve: Fix stuck TX queue for DQ queue format (Michal Schmidt) [RHEL-219261]
- gve: make IRQ handlers and page allocation NUMA aware (Michal Schmidt) [RHEL-219261]
- gve: global: fix "for a while" typo (Michal Schmidt) [RHEL-219261]
- gve: add XDP_TX and XDP_REDIRECT support for DQ RDA (Michal Schmidt) [RHEL-219261]
- gve: refactor DQO TX methods to be more generic for XDP (Michal Schmidt) [RHEL-219261]
- gve: rename gve_xdp_xmit to gve_xdp_xmit_gqi (Michal Schmidt) [RHEL-219261]
- gve: Return error for unknown admin queue command (Michal Schmidt) [RHEL-219261]
- gve: Fix various typos and improve code comments (Michal Schmidt) [RHEL-219261]
- gve: Advertise support for rx hardware timestamping (Michal Schmidt) [RHEL-219261]
- gve: Implement ndo_hwtstamp_get/set for RX timestamping (Michal Schmidt) [RHEL-219261]
- gve: Add rx hardware timestamp expansion (Michal Schmidt) [RHEL-219261]
- gve: Add support to query the nic clock (Michal Schmidt) [RHEL-219261]
- gve: Add adminq lock for queues creation and destruction (Michal Schmidt) [RHEL-219261]
- gve: Add initial PTP device support (Michal Schmidt) [RHEL-219261]
- gve: Add adminq command to report nic timestamp (Michal Schmidt) [RHEL-219261]
- gve: Add device option for nic clock synchronization (Michal Schmidt) [RHEL-219261]
- gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO (Michal Schmidt) [RHEL-219261]
- gve: Fix RX_BUFFERS_POSTED stat to report per-queue fill_cnt (Michal Schmidt) [RHEL-219261]
- gve: handle overflow when reporting TX consumed descriptors (Michal Schmidt) [RHEL-219261]
- gve: add XDP DROP and PASS support for DQ (Michal Schmidt) [RHEL-219261]
- gve: update XDP allocation path support RX buffer posting (Michal Schmidt) [RHEL-219261]
- gve: merge packet buffer size fields (Michal Schmidt) [RHEL-219261]
- gve: update GQ RX to use buf_size (Michal Schmidt) [RHEL-219261]
- gve: introduce config-based allocation for XDP (Michal Schmidt) [RHEL-219261]
- gve: remove xdp_xsk_done and xdp_xsk_wakeup statistics (Michal Schmidt) [RHEL-219261]
- gve: unlink old napi only if page pool exists (Michal Schmidt) [RHEL-219261]
- gve: convert to use netmem for DQO RDA mode (Michal Schmidt) [RHEL-219261]
- gve: unlink old napi when stopping a queue using queue API (Michal Schmidt) [RHEL-219261]
- gve: Add RSS cache for non RSS device option scenario (Michal Schmidt) [RHEL-219261]
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Michal Schmidt) [RHEL-219261]
- gve: fix XDP allocation path in edge cases (Michal Schmidt) [RHEL-219261]
- gve: process XSK TX descriptors as part of RX NAPI (Michal Schmidt) [RHEL-219261]
- gve: guard XSK operations on the existence of queues (Michal Schmidt) [RHEL-219261]
- gve: guard XDP xmit NDO on existence of xdp queues (Michal Schmidt) [RHEL-219261]
- gve: clean XDP queues in gve_tx_stop_ring_gqi (Michal Schmidt) [RHEL-219261]
- gve: Convert timeouts to secs_to_jiffies() (Michal Schmidt) [RHEL-219261]
- gve: Remove unused gve_adminq_set_mtu (Michal Schmidt) [RHEL-219261]
- gve: Flow steering trigger reset only for timeout error (Michal Schmidt) [RHEL-219261]
- gve: change to use page_pool_put_full_page when recycling pages (Michal Schmidt) [RHEL-219261]
- gve: add support for basic queue stats (Michal Schmidt) [RHEL-219261]
- gve: adopt page pool for DQ RDA mode (Michal Schmidt) [RHEL-219261]
- gve: move DQO rx buffer management related code to a new file (Michal Schmidt) [RHEL-219261]
- gve: Map NAPI instances to queues (Michal Schmidt) [RHEL-219261]
- gve: Map IRQs to NAPI instances (Michal Schmidt) [RHEL-219261]
-
Mon Sep 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.61.1.el10_2]
- perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258812] {CVE-2026-74753}
- perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250496] {CVE-2026-64556}
- perf/core: Fix missing read event generation on task exit (Anubhav Shelat) [RHEL-250496]
- KVM: arm64: Handle negative S1 walk levels in VNCR TLB size evaluation (Gavin Shan) [RHEL-261954] {CVE-2026-89775}
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (Gavin Shan) [RHEL-227043] {CVE-2026-46317}
- nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263335] {CVE-2026-89480}
- x86/mm/ident_map: Fix theoretical virtual address overflow to zero (Mark Langsdorf) [RHEL-260402]
- fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231396] {CVE-2026-53341}
- crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-254943]
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254306] {CVE-2026-80522}
- vmxnet3: fix BUG_ON in vmxnet3_get_hdr_len() for Geneve packets (CKI Backport Bot) [RHEL-252817] {CVE-2026-68299}
- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188661]
- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188661]
- KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (CKI Backport Bot) [RHEL-227378] {CVE-2026-46076}
- ext4: fix e4b bitmap inconsistency reports (CKI Backport Bot) [RHEL-225949] {CVE-2026-45942}
-
Wed Sep 23 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.60.1.el10_2]
- pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-242509] {CVE-2026-68121}
- nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263403] {CVE-2026-89481}
- af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229262] {CVE-2026-53005}
- af_unix: Don't use skb_recv_datagram() in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262]
- af_unix: Don't check SOCK_DEAD in unix_stream_read_skb(). (Davide Caratti) [RHEL-229262]
- ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255860] {CVE-2026-80714}
- drm/amdgpu/vce: fix integer overflow in image size (Mika Penttilä) [RHEL-257136] {CVE-2026-68108}
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (Mika Penttilä) [RHEL-237844] {CVE-2026-68257}
- drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236300] {CVE-2026-68266}
- drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229327] {CVE-2026-64098}
- drm/amdgpu/userq: fix access to stale wptr mapping (Mika Penttilä) [RHEL-225409] {CVE-2026-46311}
- drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (Mika Penttilä) [RHEL-225409] {CVE-2026-46311}
- drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236714] {CVE-2026-68273}
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237962] {CVE-2026-68267}
- drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229371] {CVE-2026-53290}
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (Mika Penttilä) [RHEL-225316]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225316] {CVE-2026-46230}
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225316] {CVE-2026-46230}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226047] {CVE-2026-46204}
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (Mika Penttilä) [RHEL-250108] {CVE-2025-40323}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (Mika Penttilä) [RHEL-225444] {CVE-2026-46199}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (Mika Penttilä) [RHEL-225444] {CVE-2026-46199}
- powerpc/powernv/iommu: iommu incorrectly bypass DMA APIs (Jerry Snitselaar) [RHEL-252331]
- powerpc/iommu: bypass DMA APIs for coherent allocations for pre-mapped memory (Jerry Snitselaar) [RHEL-252331]
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230647] {CVE-2026-53203}
- libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-169081] {CVE-2025-68285}
- libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169079] {CVE-2026-23136}
- libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169072] {CVE-2026-22990}
- libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169068] {CVE-2026-22984}
- libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169064] {CVE-2025-71116}
-
Tue Sep 22 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.59.1.el10_2]
- net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264371] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264303] {CVE-2026-80844}
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262556] {CVE-2026-89846}
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260585] {CVE-2026-74569}
- redhat/configs: automotive: debug: enable KASAN_INLINE (Jared Kangas) [RHEL-259788]
- watchdog: s32g_wdt: remove incorrect options in watchdog_info struct (Jared Kangas) [RHEL-259788]
- usb: chipidea: fix usage_count leak when autosuspend_delay is negative (Jared Kangas) [RHEL-259788]
- usb: chipidea: core: convert ci_role_switch to local variable (Jared Kangas) [RHEL-259788]
- usb: chipidea: otg: not wait vbus drop if use role_switch (Jared Kangas) [RHEL-259788]
- usb: chipidea: core: allow ci_irq_handler() handle both ID and VBUS change (Jared Kangas) [RHEL-259788]
- rtc: pcf85063: fix incorrect maximum clock rate handling (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: fix resume error handling (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: make non-fatal errors non-blocking in suspend (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: use pm_runtime_resume_and_get() in suspend (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: disable irq during suspend to fix unhandled interrupt (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: restore pinctrl before restoring ios timing on resume (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: fix esdhc_change_pinstate() to allow default state restore (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: restore DLL override for DDR modes on resume (Jared Kangas) [RHEL-259788]
- mmc: sdhci-esdhc-imx: remove unnecessary mmc_card_wake_sdio_irq check for tuning save/restore (Jared Kangas) [RHEL-259788]
- i2c: imx: fix locked bus on SMBus block-read of 0 (IRQ) (Jared Kangas) [RHEL-259788]
- i2c: imx: fix locked bus on SMBus block-read of 0 (atomic) (Jared Kangas) [RHEL-259788]
- i2c: imx: Cancel hrtimer before clearing slave pointer (Jared Kangas) [RHEL-259788]
- i2c: imx: Fix slave registration race and error handling (Jared Kangas) [RHEL-259788]
- i2c: imx: mark I2C adapter when hardware is powered down (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix cache_only and IRQ state on restore_context() failure (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix pca953x_irq_bus_sync_unlock regmap lock (Jared Kangas) [RHEL-259788]
- gpio: pca953x: drop bitmap_complement() where feasible (Jared Kangas) [RHEL-259788]
- gpio: pca953x: enable latch only on edge-triggered inputs (Jared Kangas) [RHEL-259788]
- gpio: pca953x: handle short interrupt pulses on PCAL devices (Jared Kangas) [RHEL-259788]
- gpio: pca953x: Add support for level-triggered interrupts (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix wrong error probe return value (Jared Kangas) [RHEL-259788]
- gpio: pca953x: fix IRQ storm on system wake up (Jared Kangas) [RHEL-259788]
- gpio: pca953x: log an error when failing to get the reset GPIO (Jared Kangas) [RHEL-259788]
- gpio: pca953x: Improve interrupt support (Jared Kangas) [RHEL-259788]
- selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-258024] {CVE-2026-72243}
- smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253205] {CVE-2026-64383}
- RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189638] {CVE-2026-23007}
- block: always allocate integrity buffer when required (Jeff Moyer) [RHEL-189638]
- block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232375] {CVE-2026-64053}
- blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230292] {CVE-2026-63802}
- bnxt_en: Gate TPH enablement behind BNXT_SUPPORTS_QUEUE_API check (CKI Backport Bot) [RHEL-247283]
- ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236084] {CVE-2026-68201}
- sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234288] {CVE-2026-64564}
- mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231034] {CVE-2026-63831}
- sctp: prevent peer transport count overflow (Xin Long) [RHEL-216247]
- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-190036] {CVE-2026-53266}
- module.lds,codetag: force 0 sh_addr for sections (Joe Lawrence) [RHEL-159298]
-
Mon Sep 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.58.1.el10_2]
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264234] {CVE-2025-39964}
-
Mon Sep 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.57.1.el10_2]
- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260452] {CVE-2026-64534}
- mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254491] {CVE-2026-74518}
- redhat/configs: automotive: enable PWM_FSL_FTM as a module (Mattijs Korpershoek) [RHEL-255517]
- arm64: dts: s32g: add PWM support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255517]
- pwm: Add the S32G support in the Freescale FTM driver (Mattijs Korpershoek) [RHEL-255517]
- pwm: fsl-ftm: Drop driver local locking (Mattijs Korpershoek) [RHEL-255517]
- pwm: fsl-ftm: Handle clk_get_rate() returning 0 (Mattijs Korpershoek) [RHEL-255517]
- libceph: bound pg_{temp,upmap,upmap_items} length to CEPH_PG_MAX_SIZE (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
- libceph: Amend checking to fix `make W=1` build breakage (CKI Backport Bot) [RHEL-237164] {CVE-2026-68159}
- Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-241107] {CVE-2026-68188}
- libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-240892] {CVE-2026-68155}
- redhat: look for secureboot-uki-virt in /etc (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec: derive pesign_name_0 from secureboot_key_0 (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec.template: Simplify uki-virt signing (Jan Stancek) [RHEL-169478]
- redhat/kernel.spec.template: Fix indentation of uki-virt generation code (Jan Stancek) [RHEL-169478]
- redhat: sign centos kernel and UKIs with 800 certs (Jan Stancek) [RHEL-169478]
- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228471]
- iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228471] {CVE-2026-45945}
- iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228471] {CVE-2026-45944}
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228471] {CVE-2026-45894}
- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236849] {CVE-2026-68391}
- net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236786] {CVE-2026-68293}
- dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231825] {CVE-2026-53062}
- crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230408] {CVE-2026-45959}
- keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225496] {CVE-2026-63823}
-
Wed Sep 16 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.56.1.el10_2]
- redhat/configs: automotive: enable SENSORS_INA2XX (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Use scoped_guard() to acquire the subsystem lock (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) clean up unused define and outdated comment (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Make it easier to add more devices (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Rely on subsystem locking (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) make regulator 'vs' support optional (Jared Kangas) [RHEL-255518]
- hwmon: (ina226) Add support for SY24655 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for INA260 (Jared Kangas) [RHEL-255518]
- hwmon: (ina2xx) Add support for has_alerts configuration flag (Jared Kangas) [RHEL-255518]
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (Jared Kangas) [RHEL-255518]
- hwmon: Support guard() and scoped_guard for subsystem locks (Jared Kangas) [RHEL-255518]
- hwmon: Serialize accesses in hwmon core (Jared Kangas) [RHEL-255518]
- wifi: ath9k: hif_usb: don't dereference hif_dev after re-arming firmware request (Izabela Bakollari) [RHEL-241004] {CVE-2026-68363}
- wifi: iwlwifi: mld: stop TX during firmware restart (Izabela Bakollari) [RHEL-243307] {CVE-2026-64175}
- wifi: iwlwifi: mvm: fix driver-set TX rates on old devices (Izabela Bakollari) [RHEL-243363] {CVE-2026-64176}
- net: wwan: t7xx: fix potential skb->frags overflow in RX path (Izabela Bakollari) [RHEL-245528] {CVE-2026-23172}
- wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap (Izabela Bakollari) [RHEL-246405] {CVE-2026-63869}
- smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254105]
- time/sched_clock: Export symbol for sched_clock register function (Eric Chanudet) [RHEL-255225]
- clocksource/drivers/nxp-pit: Fix IRQ leak on cpuhp_setup_state error path (Mattijs Korpershoek) [RHEL-255519]
- configs: Add NXP timer Kconfig options for automotive builds (Mattijs Korpershoek) [RHEL-255519]
- clocksource: move NXP timer selection to drivers/clocksource (Mattijs Korpershoek) [RHEL-255519]
- arm64: dts: s32g: add PIT support for s32g2 and s32g3 (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Prevent driver unbind (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/nxp-pit: Add NXP Automotive s32g2 / s32g3 support (Mattijs Korpershoek) [RHEL-255519]
- ARM: imx: Kconfig: Adjust select after renamed config option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rename the VF PIT to NXP PIT (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Unify the function name for irq ack (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Consolidate calls to pit_*_disable/enable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate set counter function (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Enable and disable module on error (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate clocksource enable / disable (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Use the node name for the interrupt and timer names (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the PTLCVAL macro (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Register the clocksource from the driver (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Convert raw values to BIT macros (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Allocate the struct timer at init time (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Encapsulate the initialization of the cycles_per_jiffy (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Pass the cpu number as parameter (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Rework the base address usage (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Set the scene for multiple timers (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Add COMPILE_TEST option (Mattijs Korpershoek) [RHEL-255519]
- clocksource/drivers/vf-pit: Replace raw_readl/writel to readl/writel (Mattijs Korpershoek) [RHEL-255519]
- redhat/configs: automotive: enable NVMEM_S32G_OCOTP (Mattijs Korpershoek) [RHEL-255516]
- arm64: dts: s32g: Add device tree information for the OCOTP driver (Mattijs Korpershoek) [RHEL-255516]
- nvmem: s32g-ocotp: Add driver for S32G OCOTP (Mattijs Korpershoek) [RHEL-255516]
- dt-bindings: nvmem: Add the nxp,s32g-ocotp yaml file (Mattijs Korpershoek) [RHEL-255516]
- octeontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF (Michal Schmidt) [RHEL-231041] {CVE-2026-72045}
- octeontx2-af: validate body pcifunc in rvu_mbox_handler_rep_event_notify (Michal Schmidt) [RHEL-231041] {CVE-2026-63923}
- dm_early_create: fix freeing used table on dm_resume failure (CKI Backport Bot) [RHEL-244953] {CVE-2026-72102}
- net: slip: serialize receive against buffer reallocation (CKI Backport Bot) [RHEL-241018] {CVE-2026-68143}
- net: qrtr: restrict socket creation to the initial network namespace (CKI Backport Bot) [RHEL-240243] {CVE-2026-68294}
- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (CKI Backport Bot) [RHEL-239776]
- ice: reject out-of-range ptype in ice_parser_profile_init (CKI Backport Bot) [RHEL-237211] {CVE-2026-68128}
- ALSA: timer: don't re-enter an instance callback that is still running (CKI Backport Bot) [RHEL-237201] {CVE-2026-68200}
- netfilter: handle unreadable frags (CKI Backport Bot) [RHEL-234265] {CVE-2026-64414}
- net: ena: PHC: Fix potential use-after-free in get_timestamp (CKI Backport Bot) [RHEL-230631] {CVE-2026-52971}
- ALSA: timer: Fix UAF at snd_timer_user_params() (CKI Backport Bot) [RHEL-228700] {CVE-2026-53192}
- ALSA: seq: Serialize UMP output teardown with event_input (CKI Backport Bot) [RHEL-227727] {CVE-2026-64029}
- ALSA: timer: Clear SNDRV_TIMER_IFLG_DEAD once the close completes (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- ALSA: timer: Forcibly close timer instances at closing (CKI Backport Bot) [RHEL-227086] {CVE-2026-53193}
- hwrng: virtio: clamp device-reported used.len at copy_data() (CKI Backport Bot) [RHEL-225748] {CVE-2026-64456}
- IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN (CKI Backport Bot) [RHEL-191611] {CVE-2026-53176}
- soc: qcom: socinfo: Avoid out of bounds read of serial number (CKI Backport Bot) [RHEL-191223] {CVE-2024-58007}
-
Mon Sep 14 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.55.1.el10_2]
- arm64: dts: s32g: add SAR ADC support for s32g2 and s32g3 (Jared Kangas) [RHEL-256890]
- arm64: dts: s32g3: Fix SWT8 watchdog address (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: Fix the delay calculation in nxp_sar_adc_wait_for() (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: harden buffer ISR against per-channel read failure (Albert Esteve) [RHEL-256890]
- iio: adc: nxp-sar-adc: Remove unnecessary type casting (Albert Esteve) [RHEL-256890]
- iio: core: fix uninitialized data in debugfs (Albert Esteve) [RHEL-256890]
- iio: fix potential out-of-bound write (Albert Esteve) [RHEL-256890]
- iio: core: make use of simple_write_to_buffer() (Albert Esteve) [RHEL-256890]
- iio: buffer: Move from int64_t to s64 for timestamp (Albert Esteve) [RHEL-256890]
- iio: buffer: Fix DMA fence leak in iio_buffer_enqueue_dmabuf() (Albert Esteve) [RHEL-256890]
- iio: Replace 'sign' field with union in struct iio_scan_type (Albert Esteve) [RHEL-256890]
- iio: buffer: ensure repeat alignment is a power of two (Albert Esteve) [RHEL-256890]
- iio: buffer: cache timestamp offset in scan buffer (Albert Esteve) [RHEL-256890]
- iio: buffer: check return value of iio_compute_scan_bytes() (Albert Esteve) [RHEL-256890]
- iio: core: Clean up device correctly on viio_trigger_alloc() failure (Albert Esteve) [RHEL-256890]
- iio: core: Simplify IIO core managed APIs (Albert Esteve) [RHEL-256890]
- iio: inkern: call iio_device_put() only on mapped devices (Albert Esteve) [RHEL-256890]
- iio: Fix fwnode_handle in __fwnode_iio_channel_get_by_name() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Use dev_err_probe() to simplify code (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Use managed API dmaenginem_async_device_register() (Albert Esteve) [RHEL-256890]
- dmaengine: of_dma: Add devm_of_dma_controller_register() (Albert Esteve) [RHEL-256890]
- dt-bindings: dma: fsl-edma: add dma-channel-mask property description (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: don't explicitly disable clocks in .remove() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: drop unused module alias (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: configure tcd attr with separate src and dst settings (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Fix clk leak on alloc_chan_resources failure (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: Remove redundant check in fsl_edma_free_chan_resources() (Albert Esteve) [RHEL-256890]
- dmaengine: fsl-edma: fix channel parameter config for fixed channel requests (Albert Esteve) [RHEL-256890]
- i2c: imx: fix clock and pinctrl state inconsistency in runtime PM (Albert Esteve) [RHEL-256890]
- i2c: imx: zero-initialize dma_slave_config for eDMA (Albert Esteve) [RHEL-256890]
- i2c: imx: ensure no clock is generated after last read (Albert Esteve) [RHEL-256890]
- i2c: imx: fix i2c issue when reading multiple messages (Albert Esteve) [RHEL-256890]
- i2c: imx: preserve error state in block data length handler (Albert Esteve) [RHEL-256890]
- redhat/configs: automotive: enable NXP_SAR_ADC as a module (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: Avoid division by zero (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: zero-initialize dma_slave_config (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: fix division by zero in write_raw (Eric Chanudet) [RHEL-255233]
- iio: adc: nxp-sar-adc: Fix DMA channel leak in trigger mode (Eric Chanudet) [RHEL-255233]
- iio: buffer: Fix wait_queue not being removed (Eric Chanudet) [RHEL-255233]
- iio: core: add separate lockdep class for info_exist_lock (Eric Chanudet) [RHEL-255233]
- iio: adc: Add the NXP SAR ADC support for the s32g2/3 platforms (Eric Chanudet) [RHEL-255233]
- dt-bindings: iio: adc: Add the NXP SAR ADC for s32g2/3 platforms (Eric Chanudet) [RHEL-255233]
- iio: core: Replace lockdep_set_class() + mutex_init() by combined call (Eric Chanudet) [RHEL-255233]
- iio: core: Clean up device correctly on iio_device_alloc() failure (Eric Chanudet) [RHEL-255233]
- iio: core: add missing mutex_destroy in iio_dev_release() (Eric Chanudet) [RHEL-255233]
- iio: iio_format_list() should set stride=1 for IIO_VAL_CHAR (Eric Chanudet) [RHEL-255233]
- iio: backend: fix out-of-bound write (Eric Chanudet) [RHEL-255233]
- iio: introduce IIO_DECLARE_BUFFER_WITH_TS macros (Eric Chanudet) [RHEL-255233]
- iio: make IIO_DMA_MINALIGN minimum of 8 bytes (Eric Chanudet) [RHEL-255233]
- iio: backend: make sure to NULL terminate stack buffer (Eric Chanudet) [RHEL-255233]
- iio: core: Rework claim and release of direct mode to work with sparse. (Eric Chanudet) [RHEL-255233]
- iio: backend: fix wrong pointer passed to IS_ERR() (Eric Chanudet) [RHEL-255233]
- iio: buffer: document iio_push_to_buffers_with_ts() (Eric Chanudet) [RHEL-255233]
- iio: introduced iio_push_to_buffers_with_ts() that takes a data_total_len argument. (Eric Chanudet) [RHEL-255233]
- iio: Drop iio_device_claim_direct_scoped() and related infrastructure (Eric Chanudet) [RHEL-255233]
- iommu/vt-d: Fix UCTP context table slot when copying root entries (Desnes Nunes) [RHEL-256731]
- watchdog: fix hrtimer start when pretimeout is zero (David Arcari) [RHEL-255348]
- smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list() (Paulo Alcantara) [RHEL-230559]
- smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230559]
- smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559]
- smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230559]
- smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559]
- smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559]
- smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230559]
- smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230559]
- smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230559]
- smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230559]
- smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230559]
- smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230559]
- smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230559]
- smb: client: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559]
- smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]
- smb: server: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230559]
- smb: server: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230559]
- smb: server: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230559]
- smb: server: let recv_done() queue a refill when the peer is low on credits (Paulo Alcantara) [RHEL-230559]
- smb: server: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559]
- smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230559]
- smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230559] {CVE-2026-31539}
- scsi: libiscsi_tcp: Bound SCSI Response data segment to the connection buffer (CKI Backport Bot) [RHEL-254596] {CVE-2026-74556}
- drm/xe: Issue GGTT invalidation under lock in ggtt_node_remove (Mika Penttilä) [RHEL-222461] {CVE-2026-23466}
- drm/amdgpu: Fix use-after-free race in VM acquire (CKI Backport Bot) [RHEL-222401] {CVE-2026-43370}
- drm/i915: Fix potential overflow of shmem scatterlist length (CKI Backport Bot) [RHEL-222474] {CVE-2026-43368}
- drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat (CKI Backport Bot) [RHEL-222424] {CVE-2026-31656}
- drm/amdgpu: Fix fence put before wait in amdgpu_amdkfd_submit_ib (CKI Backport Bot) [RHEL-221279] {CVE-2026-31566}
- drm/xe: always keep track of remap prev/next (CKI Backport Bot) [RHEL-222307] {CVE-2026-31479}
- drm/xe: Open-code GGTT MMIO access protection (CKI Backport Bot) [RHEL-222461] {CVE-2026-23466}
- drm/xe/pt: Reset current_op in xe_pt_update_ops_init() (Mika Penttilä) [RHEL-236579] {CVE-2026-68264}
- mshv: Fix infinite fault loop on permission-denied GPA intercepts (Maxim Levitsky) [RHEL-245035]
- mshv: Fix error handling in mshv_region_pin (Maxim Levitsky) [RHEL-245035]
- mshv: Fix use-after-free in mshv_map_user_memory error path (Maxim Levitsky) [RHEL-245035]
- mshv: pass struct mshv_user_mem_region by reference (Maxim Levitsky) [RHEL-245035]
- mshv: Handle insufficient root memory hypervisor statuses (Maxim Levitsky) [RHEL-245035]
- mshv: Handle insufficient contiguous memory hypervisor status (Maxim Levitsky) [RHEL-245035]
- mshv: Introduce hv_deposit_memory helper functions (Maxim Levitsky) [RHEL-245035]
- mshv: Introduce hv_result_needs_memory() helper function (Maxim Levitsky) [RHEL-245035]
- mshv: Add SMT_ENABLED_GUEST partition creation flag (Maxim Levitsky) [RHEL-245035]
- mshv: Add support for integrated scheduler (Maxim Levitsky) [RHEL-245035]
- mshv: Add debugfs to view hypervisor statistics (Maxim Levitsky) [RHEL-245035]
- mshv: Add data for printing stats page counters (Maxim Levitsky) [RHEL-245035]
- mshv: Update hv_stats_page definitions (Maxim Levitsky) [RHEL-245035]
- mshv: Always map child vp stats pages regardless of scheduler type (Maxim Levitsky) [RHEL-245035]
- mshv: Improve mshv_vp_stats_map/unmap(), add them to mshv_root.h (Maxim Levitsky) [RHEL-245035]
- mshv: Use typed hv_stats_page pointers (Maxim Levitsky) [RHEL-245035]
- mshv: Ignore second stats page map result failure (Maxim Levitsky) [RHEL-245035]
- xfrm: Fix dev use-after-free in xfrm async resumption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: hold dev ref until after transport_finish NF_HOOK (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: hold device only for the asynchronous decryption (Sabrina Dubroca) [RHEL-233037] {CVE-2026-31663}
- xfrm: input: hold netns during deferred transport reinjection (Sabrina Dubroca) [RHEL-227502] {CVE-2026-63919}
- xfrm: fix stale skb->prev after async crypto steals a GSO segment (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
- xfrm: propagate -EINPROGRESS from validate_xmit_xfrm() (Sabrina Dubroca) [RHEL-236113] {CVE-2026-68426}
- xfrm: policy: fix use-after-free on inexact bin in xfrm_policy_bysel_ctx() (Sabrina Dubroca) [RHEL-228006] {CVE-2026-53239}
- ip6: vti: Use ip6_tnl.net in vti6_changelink(). (Sabrina Dubroca) [RHEL-231756] {CVE-2026-63917}
- ip6: vti: Use ip6_tnl.net in vti6_siocdevprivate(). (Sabrina Dubroca) [RHEL-228943] {CVE-2026-63921}
- af_unix: Set gc_in_progress to true in unix_gc(). (Davide Caratti) [RHEL-227544] {CVE-2026-53361}
- af_unix: Give up GC if MSG_PEEK intervened. (Davide Caratti) [RHEL-227544] {CVE-2026-23394}
- af_unix: Consolidate unix_schedule_gc() and wait_for_unix_gc(). (Davide Caratti) [RHEL-227544]
- af_unix: Remove unix_tot_inflight. (Davide Caratti) [RHEL-227544]
- af_unix: Refine wait_for_unix_gc(). (Davide Caratti) [RHEL-227544]
- af_unix: Don't call wait_for_unix_gc() on every sendmsg(). (Davide Caratti) [RHEL-227544]
- af_unix: Don't trigger GC from close() if unnecessary. (Davide Caratti) [RHEL-227544]
- af_unix: Simplify GC state. (Davide Caratti) [RHEL-227544]
- af_unix: Count cyclic SCC. (Davide Caratti) [RHEL-227544]
- af_unix: Initialise scc_index in unix_add_edge(). (Davide Caratti) [RHEL-227544]
- af_unix: Clean up #include under net/unix/. (Davide Caratti) [RHEL-227544]
- af_unix: Explicitly include headers for non-pointer struct fields. (Davide Caratti) [RHEL-227544]
- af_unix: Sort headers. (Davide Caratti) [RHEL-227544]
- unix: fix up for "apparmor: add fine grained af_unix mediation" (Davide Caratti) [RHEL-227544]
- af_unix: Move internal definitions to net/unix/. (Davide Caratti) [RHEL-227544]
- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190194]
- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190194] {CVE-2026-53246}
- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-235912] {CVE-2025-68745}
- lsm: hold cred_guard_mutex for lsm_set_self_attr() (Ricardo Robaina) [RHEL-226807] {CVE-2026-64111}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-231909] {CVE-2025-40149}
- netfilter: require Ethernet MAC header before using eth_hdr() (CKI Backport Bot) [RHEL-230672] {CVE-2026-53131}
- scsi: scsi_transport_fc: Widen FPIN pname walker counter to u32 (CKI Backport Bot) [RHEL-228717] {CVE-2026-63889}
- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225792] {CVE-2026-46149}
- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188199] {CVE-2026-52924}
- vhost: move vdpa group bound check to vhost_vdpa (CKI Backport Bot) [RHEL-174283] {CVE-2026-43248}