-
Wed Apr 30 2025 Darren Archibald <darren.archibald@oracle.com> [5.14.0-503.40.1.el9_5.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
-
Wed Apr 23 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.40.1.el9_5]
- nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Chris Leech) [RHEL-87479] {CVE-2025-21927}
- ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-75438] {CVE-2024-42322}
- bonding: fix null pointer deref in bond_ipsec_offload_ok (CKI Backport Bot) [RHEL-75453] {CVE-2024-44990}
- smb: client: don't retry IO on failed negprotos with soft mounts (Jay Shin) [RHEL-85523]
- bonding: Correctly support GSO ESP offload (CKI Backport Bot) [RHEL-73403]
- team: prevent adding a device which is already a team device lower (Hangbin Liu) [RHEL-73403]
- team: Fix feature exposure when no ports are present (Hangbin Liu) [RHEL-73403]
- team: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL (Hangbin Liu) [RHEL-73403]
- team: Fix initial vlan_feature set in __team_compute_features (Hangbin Liu) [RHEL-73403]
- bonding: Fix feature propagation of NETIF_F_GSO_ENCAP_ALL (Hangbin Liu) [RHEL-73403]
- bonding: Fix initial {vlan,mpls}_feature set in bond_compute_features (Hangbin Liu) [RHEL-73403]
- net, team, bonding: Add netdev_base_features helper (Hangbin Liu) [RHEL-73403]
- bonding: add ESP offload features when slaves support (Hangbin Liu) [RHEL-73403]
- net: team: rename team to team_core for linking (Hangbin Liu) [RHEL-73403]
- netfilter: br_netfilter: fix panic with metadata_dst skb (Ivan Vecera) [RHEL-71956]
- bridge: mcast: Fail MDB get request on empty entry (Ivan Vecera) [RHEL-71956]
- net: stmmac: dwmac-tegra: Fix link bring-up sequence (Jose Ignacio Tornos Martinez) [RHEL-73478]
- kobject_uevent: Fix OOB access within zap_modalias_env() (CKI KWF BOT) [RHEL-75435] {CVE-2024-42292}
-
Mon Apr 14 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.39.1.el9_5]
- igb: cope with large MAX_SKB_FRAGS (Corinna Vinschen) [RHEL-75552]
- x86/sev: Ensure that RMP table fixups are reserved (Bandan Das) [RHEL-84716]
- ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-75456] {CVE-2024-46826}
- smb: client: fix double put of @cfile in smb2_set_path_size() (Paulo Alcantara) [RHEL-79342] {CVE-2024-46796}
- smb: client: fix double put of @cfile in smb2_rename_path() (Paulo Alcantara) [RHEL-79342] {CVE-2024-46736}
- smb: client: fix FSCTL_GET_REPARSE_POINT against NetApp (Paulo Alcantara) [RHEL-79342]
-
Mon Apr 14 2025 Chao YE <cye@redhat.com> [5.14.0-503.38.1.el9_5]
- ALSA: usb-audio: Fix out of bounds reads when finding clock sources (CKI Backport Bot) [RHEL-86726] {CVE-2024-53150}
-
Sun Apr 06 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.37.1.el9_5]
- scsi: core: Fix command pass through retry regression (Ewan D. Milne) [RHEL-77123]
-
Sun Mar 30 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.36.1.el9_5]
- cpufreq: intel_pstate: Support Emerald Rapids OOB mode (Steve Best) [RHEL-67636]
- cxgb4: use port number to set mac addr (Michal Schmidt) [RHEL-79672]
- ice: stop storing XDP verdict within ice_rx_buf (Petr Oros) [RHEL-76141]
- ice: gather page_count()'s of each frag right before XDP prog call (Petr Oros) [RHEL-76141]
- ice: put Rx buffers after being done with current frame (Petr Oros) [RHEL-76141]
- gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-74413]
- gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-74413]
- gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-74413] {CVE-2024-57933}
- gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-74413] {CVE-2024-57932}
- gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-74413]
- gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-74413]
- gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-74413] {CVE-2024-40937}
- gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-74413]
-
Sun Mar 23 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.35.1.el9_5]
- cppc_cpufreq: Use desired perf if feedback ctrs are 0 or unchanged (Mark Langsdorf) [RHEL-78643]
- coresight: etm4x: Add ACPI support in platform driver (Mark Salter) [RHEL-80223]
- block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-73024]
- md: fix deadlock between mddev_suspend and flush bio (Nigel Croxon) [RHEL-76058] {CVE-2024-43855}
- redhat/configs: replace IOMMU_DEFAULT_DMA_STRICT with IOMMU_DEFAULT_DMA_LAZY (Jerry Snitselaar) [RHEL-76412]
- ibmvnic: Only record tx completed bytes once per handler (Mamatha Inamdar) [RHEL-71289]
- ibmvnic: Only replenish rx pool when resources are getting low (Mamatha Inamdar) [RHEL-71289]
- ibmvnic: Return error code on TX scrq flush fail (Mamatha Inamdar) [RHEL-71289]
- intel_idle: fix ACPI _CST matching for newer Xeon platforms (David Arcari) [RHEL-62987]
-
Mon Mar 17 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.34.1.el9_5]
- arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82734] {CVE-2025-21785}
- crypto: rng - Fix extrng EFAULT handling (Herbert Xu) [RHEL-70643]
-
Wed Mar 12 2025 Chao YE <cye@redhat.com> [5.14.0-503.33.1.el9_5]
- scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-62266]
- scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-62266]
- scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-62266]
- x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Chris von Recklinghausen) [RHEL-62210]
- SUNRPC: Handle -ETIMEDOUT return from tlshd (Benjamin Coddington) [RHEL-79870]
- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (Benjamin Coddington) [RHEL-79870]
- tls: Fix tls_sw_sendmsg error handling (Benjamin Coddington) [RHEL-79870]
- SUNRPC: Fix a hang in TLS sock_close if sk_write_pending (Benjamin Coddington) [RHEL-79870]
-
Sun Mar 09 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-503.32.1.el9_5]
- SUNRPC: Handle -ETIMEDOUT return from tlshd (Benjamin Coddington) [RHEL-79870]
- SUNRPC: timeout and cancel TLS handshake with -ETIMEDOUT (Benjamin Coddington) [RHEL-79870]
- tls: Fix tls_sw_sendmsg error handling (Benjamin Coddington) [RHEL-79870]
- SUNRPC: Fix a hang in TLS sock_close if sk_write_pending (Benjamin Coddington) [RHEL-79870]