-
Thu Oct 15 2026 EL Errata <el-errata_ww@oracle.com> [5.14.0-687.58.1.el9_8.OL9]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
-
Wed Oct 14 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.58.1.el9_8]
- net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link() (Jan Polensky) [RHEL-271472] {CVE-2026-80985}
- KVM: arm64: vgic: Handle race between interrupt affinity change and LPI disabling (Mohammadfaiz Bawa) [RHEL-243814] {CVE-2026-72288}
- SUNRPC: Zero rpc_gss_wire_cred at svcauth_gss_decode_credbody() entry (Olga Kornievskaia) [RHEL-275058] {CVE-2026-93207}
- svcrdma: Reject Write/Reply chunks with segcount 0 (Olga Kornievskaia) [RHEL-275076] {CVE-2026-93228}
- NFSD: Prevent client use-after-free during blocked-lock reaping (Olga Kornievskaia) [RHEL-270929] {CVE-2026-90036}
- NFSD: Prevent client use-after-free during delegation revoke (Olga Kornievskaia) [RHEL-270929] {CVE-2026-89659}
- svcrdma: Validate Read chunk positions before reconstruction (Olga Kornievskaia) [RHEL-271453] {CVE-2026-89526}
- udp: fix potential use-after-free in tunnel segmentation (Antoine Tenart) [RHEL-268122] {CVE-2026-74705}
- net/iucv: filter frames in afiucv_hs_rcv() by ingress device (CKI Backport Bot) [RHEL-270908] {CVE-2026-81003}
- wifi: cfg80211: use wiphy work for socket owner autodisconnect (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404}
- wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404}
- wifi: cfg80211: cancel pmsr_free_wk in cfg80211_pmsr_wdev_down (Jose Ignacio Tornos Martinez) [RHEL-240485] {CVE-2026-68404}
- wifi: mac80211: defer link RX stats percpu free to RCU (Jose Ignacio Tornos Martinez) [RHEL-263788] {CVE-2026-68409}
- wifi: mac80211: bounds-check link_id in ieee80211_ml_epcs (Jose Ignacio Tornos Martinez) [RHEL-259560] {CVE-2026-64030}
- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (CKI Backport Bot) [RHEL-261686] {CVE-2026-72262}
- net/iucv: fix use-after-free of a severed iucv_path (CKI Backport Bot) [RHEL-260511] {CVE-2026-68140}
- netfilter: nft_lookup: fix catchall element handling with inverted lookups (CKI Backport Bot) [RHEL-261293] {CVE-2026-72320}
- ALSA: usx2y: bound the hwdep mmap fault offset (CKI Backport Bot) [RHEL-256448] {CVE-2026-74641}
- net/sched: act_tunnel_key: Defer dst_release to RCU callback (CKI Backport Bot) [RHEL-237219] {CVE-2026-68377}
- net/sched: act_ct: Only release RCU read lock after ct_ft (CKI Backport Bot) [RHEL-229654] {CVE-2026-46319}
- net/sched: taprio: fix use-after-free in advance_sched() on schedule switch (CKI Backport Bot) [RHEL-226490] {CVE-2026-53011}
-
Fri Oct 09 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.57.1.el9_8]
- nvmet-auth: Synchronize timeout work during SQ teardown (CKI Backport Bot) [RHEL-276348] {CVE-2026-89970}
- drm/amdkfd: Add TLB flush after MES queue eviction/suspension (José Expósito) [RHEL-262131] {CVE-2026-89811}
- drm/xe/uapi: Reject coh_none PAT index for CPU cached memory in madvise (José Expósito) [RHEL-250806] {CVE-2026-46309}
- drm/xe: Fix memory leak in xe_vm_madvise_ioctl (José Expósito) [RHEL-250806]
- drm/amd/display: set new_stream to NULL after release (CKI Backport Bot) [RHEL-260532] {CVE-2026-68236}
- drm/vmwgfx: use check_add_overflow for shader size+offset bound (CKI Backport Bot) [RHEL-258162] {CVE-2026-80887}
- drm/amdgpu: fix lifetime issue of amdgpu_vm_get_task_info_pasid() (CKI Backport Bot) [RHEL-236241] {CVE-2026-68245}
- drm/dp/mst: fix buffer overflows in sideband chunk accumulation (CKI Backport Bot) [RHEL-240851] {CVE-2026-68278}
- bpf: Restrict JIT predictor flush to cBPF (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
- x86/bugs: Enable IBPB flush on BPF JIT allocation (Viktor Malik) [RHEL-273998] {CVE-2026-64507}
- bpf: Support for hardening against JIT spraying (Viktor Malik) [RHEL-273882] {CVE-2026-64508}
- openvswitch: fix GSO userspace truncation underflow (CKI Backport Bot) [RHEL-263867] {CVE-2026-68123}
- media: cx231xx: reject geometry changes while the VBI queue is busy (CKI Backport Bot) [RHEL-262527] {CVE-2026-89894}
- macsec: fix replay protection at XPN lower-PN wrap (Abhishek Rawal) [RHEL-226673] {CVE-2026-63925}
- cifs: validate DFS referral string offsets (CKI Backport Bot) [RHEL-261999] {CVE-2026-72318}
-
Wed Oct 07 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.56.1.el9_8]
- ice: use per-interface clock_id for E825 generic DPLLs (Jakub Ramaseuski) [RHEL-183201]
- ice: add TSPLL DPLL device and TIME_REF pin for E825 (Jakub Ramaseuski) [RHEL-183201]
- ice: monitor TSPLL lock from PTP periodic worker (Jakub Ramaseuski) [RHEL-183201]
- ice: suppress DPLL errors during reset recovery (Jakub Ramaseuski) [RHEL-183201]
- redhat/configs: Enable Epson RX8111 RTC driver (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: Adapt upstream driver for kernel 5.14 (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: handle VLOW flag (CKI Backport Bot) [RHEL-212014]
- rtc: rx8111: demote warnings to debug level (CKI Backport Bot) [RHEL-212014]
- rtc: Add driver for Epson RX8111 (CKI Backport Bot) [RHEL-212014]
- nfsd: defer vfree of compound ops to fix rpc_status UAF (Roberto Bergantinos Corpas) [RHEL-264950] {CVE-2026-89690}
- svcrdma: Reject inline replies that overflow the pull-up buffer (Roberto Bergantinos Corpas) [RHEL-187734] {CVE-2026-89530}
- nfsd: initialize copy-notify stateid before publishing it (Roberto Bergantinos Corpas) [RHEL-264186] {CVE-2026-89669}
- nfsd: revoke copy-notify stateids before dropping their reference (Roberto Bergantinos Corpas) [RHEL-264152] {CVE-2026-89663}
- nfsd: check client ownership when cancelling a copy-notify stateid (Roberto Bergantinos Corpas) [RHEL-264152]
- nfsd: fix cpntf publish race in nfs4_init_cp_state (Roberto Bergantinos Corpas) [RHEL-264152]
- NFSD: Fix SECINFO_NO_NAME decode error cleanup (Roberto Bergantinos Corpas) [RHEL-259240] {CVE-2026-53398}
- SUNRPC: pin upper rpc_clnt across the TLS connect_worker (Roberto Bergantinos Corpas) [RHEL-261480] {CVE-2026-72317}
- vlan: fix skb_under_panic and races when toggling HW VLAN offload (Vb Vasu) [RHEL-254246]
- macvlan: inherit needed_headroom and needed_tailroom from lowerdev (Vb Vasu) [RHEL-254246]
- ipvlan: inherit needed_headroom and needed_tailroom from phy_dev (Vb Vasu) [RHEL-254246] {CVE-2026-74744}
- ipvlan: Make the addrs_lock be per port (Vb Vasu) [RHEL-246115] {CVE-2026-23103}
- sched/rt,dl: Skip migrate-disabled tasks when picking a push candidate (Herton R. Krzesinski) [RHEL-256279]
- sched: Make class_schedulers avoid pushing current, and get rid of proxy_tag_curr() [partial] (Herton R. Krzesinski) [RHEL-256279]
- vsock/virtio: bind uarg before filling zerocopy skb (Jon Maloy) [RHEL-229027] {CVE-2026-63970}
- vsock/virtio: fix zerocopy completion for multi-skb sends (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting (Jon Maloy) [RHEL-232843] {CVE-2026-53365}
- idpf: fix max_vport related crash on allocation error during init (Michal Schmidt) [RHEL-243408] {CVE-2026-68291}
- idpf: fix double free and use-after-free in aux device error paths (Michal Schmidt) [RHEL-243408] {CVE-2026-53286}
- idpf: fix read_dev_clk_lock spinlock init in idpf_ptp_init() (Michal Schmidt) [RHEL-243408] {CVE-2026-64162}
- idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling (Michal Schmidt) [RHEL-243408] {CVE-2026-31647}
- KVM: SEV: Use READ_ONCE() when reading entries/indices from PSC buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Check PSC request indices against the actual size of the buffer (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Don't explicitly pass PSC buffer to snp_begin_psc() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: WARN if KVM attempts to setup scratch area with min_len==0 (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Compute the correct max length of the in-GHCB scratch area (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Use the size of the PSC header as the minimum size for PSC requests (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore Port I/O requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Reject MMIO requests larger than 8 bytes with GHCB v2+ (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Provide helpers to set the error code (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SVM: Convert plain error code numbers to defines (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Ignore MMIO requests of length '0' (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Consolidate SEV-ES MMIO emulation into a single public API (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Dedup kvm_sev_es_mmio_{read,write}() (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: x86: Harden SEV-ES MMIO against on-stack use-after-free (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- KVM: SEV: Require in-GHCB scratch area if GHCB v2+ is in use (Rahul Kumar) [RHEL-192284] {CVE-2026-53360}
- x86/vmware: Fix hypercall clobbers (Jon Maloy) [RHEL-186577]
- vsock/vmci: fix UAF when peer resets connection during handshake (CKI Backport Bot) [RHEL-232270] {CVE-2026-64115}
- igc: set tx buffer type for SMD frames (CKI Backport Bot) [RHEL-227034] {CVE-2026-64035}
- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (CKI Backport Bot) [RHEL-169480]
-
Mon Oct 05 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.55.1.el9_8]
- dmaengine: idxd: Fix refcount underflow on module unload (Jerry Snitselaar) [RHEL-274410]
- nvme/ioctl: check SUBMIT_IO with nvme_cmd_allowed() (CKI Backport Bot) [RHEL-269504] {CVE-2026-90227}
- s390/cpum_cf: Handle CPU hotplug via prepare/dead callbacks (Jan Polensky) [RHEL-270892]
- netfilter: nfnetlink_log: wait for rcu grace period before freeing pernet state (CKI Backport Bot) [RHEL-271672] {CVE-2026-93288}
- thermal: core: Fix thermal zone device registration error path (Dennis Chen) [RHEL-226822] {CVE-2026-43332}
- nvme: add missing SRCU grace period in error path (CKI Backport Bot) [RHEL-270902] {CVE-2026-89972}
- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (CKI Backport Bot) [RHEL-270670] {CVE-2026-97417}
- KVM: arm64: Reassign nested_mmus array behind mmu_lock (Jon Maloy) [RHEL-227040] {CVE-2026-46317}
- Bluetooth: hci_uart: clear HCI_UART_SENDING when write_work is canceled (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275}
- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (CKI Backport Bot) [RHEL-232611] {CVE-2026-46275}
- io_uring/kbuf: check if target buffer list is still legacy on recycle (David Jeffery) [RHEL-254192]
- nvme-tcp: fix host memory disclosure on R2T for a read command (CKI Backport Bot) [RHEL-263460] {CVE-2026-89481}
- nvme-tcp: reject a read that transferred too few bytes (CKI Backport Bot) [RHEL-263369] {CVE-2026-89480}
- ipv6: add NULL checks for idev in SRv6 paths (Antoine Tenart) [RHEL-257690] {CVE-2026-23442}
- ipv6: fix use-after-free in ip6_finish_output2() (Antoine Tenart) [RHEL-258675] {CVE-2026-80792}
- ipv6: exthdrs: refresh nh pointer after ipv6_hop_jumbo() (Antoine Tenart) [RHEL-259361] {CVE-2026-63924}
- ipv6: exthdrs: refresh nh after handling HAO option (Antoine Tenart) [RHEL-259413] {CVE-2026-63922}
- ipv6: rpl: fix hdrlen overflow in ipv6_rpl_srh_decompress() (Antoine Tenart) [RHEL-231279] {CVE-2026-63984}
- ipv6: validate extension header length before copying to cmsg (Antoine Tenart) [RHEL-225381] {CVE-2026-63920}
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231351] {CVE-2026-64557}
- vxlan: do not reuse cached ip_hdr() value after skb_tunnel_check_pmtu() (Abhishek Rawal) [RHEL-231721] {CVE-2026-63993}
- tunnels: load network headers after skb_cow() in iptunnel_pmtud_build_icmp[v6]() (Abhishek Rawal) [RHEL-259588] {CVE-2026-63994}
- tunnels: do not assume transport header in iptunnel_pmtud_check_icmp() (Abhishek Rawal) [RHEL-230774] {CVE-2026-63992}
- vxlan: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-238889] {CVE-2026-68432}
- net: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247004] {CVE-2026-72052}
- net: ip_gre: require CAP_NET_ADMIN in the device netns for changelink (Abhishek Rawal) [RHEL-247040] {CVE-2026-63829}
- hwmon: (core) Use device name as a fallback in devm_hwmon_device_register_with_info (CKI Backport Bot) [RHEL-262029]
- netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp() (CKI Backport Bot) [RHEL-260635] {CVE-2026-74569}
- smb: client: fix double-free in SMB2_ioctl() replay (CKI Backport Bot) [RHEL-259778] {CVE-2026-64385}
- KVM: s390: vsie: zero stale crypto bits (CKI Backport Bot) [RHEL-258123] {CVE-2026-80921}
- dm-integrity: don't increment hash_offset twice (CKI Backport Bot) [RHEL-257771] {CVE-2026-72099}
- KVM: nSVM: Raise #UD if unhandled VMMCALL isn't intercepted by L1 (Jon Maloy) [RHEL-227374] {CVE-2026-46076}
- KVM: SVM: Update x2APIC MSR intercepts if AVIC is inhibited while L2 is active (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- KVM: SVM: Move x2AVIC MSR interception helper to avic.c (Jon Maloy) [RHEL-254524] {CVE-2026-74516}
- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-229777]
- Bluetooth: fix UAF in bt_accept_dequeue() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (CKI Backport Bot) [RHEL-229777] {CVE-2026-53357}
- ipvs: clear IPv4 options after rebasing tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- ipvs: ensure inner headers in ICMP errors are in headroom (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (CKI Backport Bot) [RHEL-254400] {CVE-2026-74669}
- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (CKI Backport Bot) [RHEL-252427] {CVE-2026-72255}
- KVM: arm64: vgic: Check the interrupt is still ours before migrating it (CKI Backport Bot) [RHEL-252481] {CVE-2026-72289}
- netfilter: flowtable: publish GC-visible tuple last (CKI Backport Bot) [RHEL-250570] {CVE-2026-74746}
- netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232060] {CVE-2026-52942}
- netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232031] {CVE-2026-52986}
- gfs2: add some missing log locking (CKI Backport Bot) [RHEL-230316] {CVE-2026-53049}
- gfs2: Fix slab-use-after-free in qd_put (CKI Backport Bot) [RHEL-227553] {CVE-2026-45861}
- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (CKI Backport Bot) [RHEL-189937] {CVE-2025-40149}
-
Wed Sep 30 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.54.1.el9_8]
- Revert "mm/memcg: refactor try_charge_memcg retry logic to use for loop" (Audra Mitchell) [RHEL-269060]
- futex: Prevent rcuwait use-after-free during requeue PI (Waiman Long) [RHEL-263481] {CVE-2026-90003}
- futex: Fix might_sleep() warning in futex_pivot_pending() (Waiman Long) [RHEL-263481]
- futex: Fix race on the initial mm->futex.phash.ref allocation (Waiman Long) [RHEL-263481] {CVE-2026-80775}
- futex/pi: Reject cross-mm private futex owners (Waiman Long) [RHEL-263481] {CVE-2026-80778}
- futex: Avoid private hash use-after-free on final put (Waiman Long) [RHEL-263481] {CVE-2026-80758}
- futex: Fix race in futex_pivot_pending() during private hash resize (Waiman Long) [RHEL-263481] {CVE-2026-80776}
- futex: Prevent robust futex exit race some more (Waiman Long) [RHEL-263481] {CVE-2026-74658}
- futex: Optimize futex hash bucket access patterns (Waiman Long) [RHEL-263481]
- compiler_types.h: add "auto" as a macro for "__auto_type" (Waiman Long) [RHEL-263481]
- selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169936]
- selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169936]
- selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169936]
- net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169936]
- net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169936]
- RDMA/uverbs: Validate wqe_size before using it in ib_uverbs_post_send (CKI Backport Bot) [RHEL-232599] {CVE-2026-45856}
- KVM: SVM: Fix page overflow in sev_dbg_crypt() for ENCRYPT path (CKI Backport Bot) [RHEL-214951] {CVE-2026-63794}
-
Mon Sep 28 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.53.1.el9_8]
- arm64: tlb: Flush walk cache when unsharing PMD tables (Rafael Aquini) [RHEL-259312] {CVE-2026-63875}
- perf: Reject exited events as group leaders (Anubhav Shelat) [RHEL-258817] {CVE-2026-74753}
- perf/core: Detach event groups during remove_on_exec (Anubhav Shelat) [RHEL-250504] {CVE-2026-64556}
- ext4: fix e4b bitmap inconsistency reports (Lukas Herbolt) [RHEL-225944] {CVE-2026-45942}
- crypto: af_alg - Cap AEAD AD length to 0x80000000 (CKI Backport Bot) [RHEL-259061] {CVE-2026-52972}
- fhandle: fix UAF due to unlocked ->mnt_ns read in may_decode_fh() (Abhi Das) [RHEL-231391] {CVE-2026-53341}
- crypto: testmgr - block Crypto API xxhash64 in FIPS mode (Vladislav Dronov) [RHEL-256437]
- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-254308] {CVE-2026-80522}
- RDMA/rxe: Fix iova-to-va conversion for MR page sizes != PAGE_SIZE (Kamal Heib) [RHEL-230788] {CVE-2026-46325}
- RDMA/rxe: Remove unused page_offset member (Kamal Heib) [RHEL-230788]
- RDMA/rxe: Remove redundant assignment to variable page_offset (Kamal Heib) [RHEL-230788]
- Revert "RDMA/rxe: RHEL-only revert for page size vars in rxe" (Kamal Heib) [RHEL-230788]
- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-188656]
- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-188656]
- RDMA/siw: Reject MPA FPDU length underflow before signed receive math (CKI Backport Bot) [RHEL-232566] {CVE-2026-64102}
- rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets (Marc Dionne) [RHEL-179563]
- rxrpc: Fix potential UAF after skb_unshare() failure (Marc Dionne) [RHEL-179563] {CVE-2026-45998}
-
Wed Sep 23 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.52.1.el9_8]
- pppoe: reload header pointer after dev_hard_header() (Guillaume Nault) [RHEL-237295] {CVE-2026-68121}
- mm/readahead: reintroduce legacy madvise_willneed behavior to force_page_cache_readahead (John J. Coleman) [RHEL-260938]
- smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush() (Paulo Alcantara) [RHEL-230561]
- smb: client: let send_done handle a completion without IB_SEND_SIGNALED (Paulo Alcantara) [RHEL-230561]
- smb: client: let smbd_post_send_negotiate_req() use smbd_post_send() (Paulo Alcantara) [RHEL-230561]
- smb: client: fix last send credit problem causing disconnects (Paulo Alcantara) [RHEL-230561]
- smb: client: make use of smbdirect_socket.send_io.bcredits (Paulo Alcantara) [RHEL-230561]
- smb: client: use smbdirect_send_batch processing (Paulo Alcantara) [RHEL-230561]
- smb: client: introduce and use smbd_{alloc, free}_send_io() (Paulo Alcantara) [RHEL-230561]
- smb: client: split out smbd_ib_post_send() (Paulo Alcantara) [RHEL-230561]
- smb: client: let smbd_post_send() make use of request->wr (Paulo Alcantara) [RHEL-230561]
- smb: client: port and use the wait_for_credits logic used by server (Paulo Alcantara) [RHEL-230561]
- smb: client: remove pointless sc->send_io.pending handling in smbd_post_send_iter() (Paulo Alcantara) [RHEL-230561]
- smb: client: remove pointless sc->recv_io.credits.count rollback (Paulo Alcantara) [RHEL-230561]
- smb: client: make use of smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561]
- smb: smbdirect: introduce smbdirect_socket.send_io.bcredits.* (Paulo Alcantara) [RHEL-230561]
- smb: smbdirect: introduce smbdirect_socket.recv_io.credits.available (Paulo Alcantara) [RHEL-230561] {CVE-2026-31539}
- ipvs: do not propagate one-packet flag to synced conns (CKI Backport Bot) [RHEL-255848] {CVE-2026-80714}
- drm/amdgpu/userq: fix access to stale wptr mapping (José Expósito) [RHEL-225416] {CVE-2026-46311}
- drm/amdgpu: do not use amdgpu_bo_gpu_offset_no_check individually (José Expósito) [RHEL-225416]
- drm/xe: Hold a dma-buf reference for imported BOs (CKI Backport Bot) [RHEL-236304] {CVE-2026-68266}
- drm/amdgpu: Fix context pstate override handling (CKI Backport Bot) [RHEL-236711] {CVE-2026-68273}
- drm/xe/rtp: Add RING_FORCE_TO_NONPRIV_DENY to OA whitelists (CKI Backport Bot) [RHEL-237964] {CVE-2026-68267}
- drm/xe/rtp: Refactor OAG MMIO trigger register whitelisting (CKI Backport Bot) [RHEL-237964]
- drm/xe/xe3: Apply wa_14024997852 (CKI Backport Bot) [RHEL-237964]
- drm/amdkfd: fix 32-bit overflow in CWSR total size calculation (CKI Backport Bot) [RHEL-237833] {CVE-2026-68257}
- drm/virtio: use uninterruptible resv lock for plane updates (CKI Backport Bot) [RHEL-229328] {CVE-2026-64098}
- drm/amdgpu/vcn: fix integer overflow in dec_msg buffer count check (José Expósito) [RHEL-225299]
- drm/amdgpu/vcn3: Avoid overflow on msg bound check (José Expósito) [RHEL-225299]
- drm/amdgpu/vcn3: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225299] {CVE-2026-46230}
- fbcon: Set fb_display[i]->mode to NULL when the mode is released (José Expósito) [RHEL-250107] {CVE-2025-40323}
- drm/amdgpu/vce: fix integer overflow in image size (CKI Backport Bot) [RHEL-237636] {CVE-2026-68108}
- drm/xe/eustall: Fix drm_dev_put called before stream disable in close (CKI Backport Bot) [RHEL-229378] {CVE-2026-53290}
- drm/amdgpu/vcn4: Prevent OOB reads when parsing IB (CKI Backport Bot) [RHEL-226050] {CVE-2026-46204}
- drm/amdgpu/vcn4: Avoid overflow on msg bound check (José Expósito) [RHEL-225443]
- drm/amdgpu/vcn4: Prevent OOB reads when parsing dec msg (José Expósito) [RHEL-225443] {CVE-2026-46199}
- netfilter: nf_queue: hold bridge skb->dev while queued (CKI Backport Bot) [RHEL-231247] {CVE-2026-52912}
- accel/ivpu: Add buffer overflow check in MS get_info_ioctl (CKI Backport Bot) [RHEL-230650] {CVE-2026-53203}
-
Tue Sep 22 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.51.1.el9_8]
- net: tun: bound receive headroom (CKI Backport Bot) [RHEL-264401] {CVE-2026-81000}
- xfrm: ah6: validate routing header segments_left (CKI Backport Bot) [RHEL-264350] {CVE-2026-80844}
- scsi: qla2xxx: Bound rsp_info_len to avoid OOB sense-data read (CKI Backport Bot) [RHEL-262595] {CVE-2026-89846}
- nvmet-tcp: check INIT_FAILED before nvmet_req_uninit in digest error path (CKI Backport Bot) [RHEL-260449] {CVE-2026-64534}
- af_unix: Drop all SCM attributes for SOCKMAP. (Davide Caratti) [RHEL-229264] {CVE-2026-53005}
- smb: client: fix double-free in SMB2_flush() replay (CKI Backport Bot) [RHEL-253169] {CVE-2026-64383}
- RHEL: revert "block: only zero non-PI metadata tuples in bio_integrity_prep" (Jeff Moyer) [RHEL-189969] {CVE-2026-23007}
- block: don't overwrite bip_vcnt in bio_integrity_copy_user() (Jeff Moyer) [RHEL-232369] {CVE-2026-64053}
- blk-cgroup: fix UAF in __blkcg_rstat_flush() (Jeff Moyer) [RHEL-230287] {CVE-2026-63802}
- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (CKI Backport Bot) [RHEL-243625] {CVE-2026-72261}
- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-236634]
- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-236634]
- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-236634]
- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-236634]
- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-236634]
- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-236634]
- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-236634] {CVE-2026-64006}
- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-236634] {CVE-2026-53134}
- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-236634] {CVE-2026-53218}
- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-236634] {CVE-2026-53267}
- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-53212}
- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-236634] {CVE-2026-52970}
- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-236634]
- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-236634]
- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-236634]
- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-236634] {CVE-2026-46324}
- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-236634]
- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-236634] {CVE-2026-52998}
- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-236634] {CVE-2026-52999}
- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-236634] {CVE-2026-31665}
- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-236634] {CVE-2026-43024}
- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-236634] {CVE-2026-31416}
- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-236634] {CVE-2026-23278}
- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-236634] {CVE-2026-23351}
- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-236634] {CVE-2026-23385}
- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-236634] {CVE-2025-68206}
- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-236634]
- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-236634] {CVE-2025-40206}
- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-236634]
- netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-236634]
- selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-236634] {CVE-2024-56655}
- netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-236634] {CVE-2025-39867}
- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-236634]
- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-236634] {CVE-2025-38201}
- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-236634] {CVE-2025-38162}
- netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-236634]
- netfilter: nft_ct: drop pending enqueued packets on removal (Florian Westphal) [RHEL-236634] {CVE-2026-43060}
- netfilter: nf_tables: cleanup documentation (Florian Westphal) [RHEL-236634]
- nf_tables: nft_dynset: fix possible stateful expression memleak in error path (Florian Westphal) [RHEL-236634] {CVE-2026-23399}
- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-236634]
- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-236634] {CVE-2026-53001}
- netfilter: nf_tables: avoid false-positive lockdep splats with basechain hook (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: use rcu chain hook list iterator from netlink dump path (Florian Westphal) [RHEL-236634]
- netfilter: nft_set_bitmap: fix lockdep splat due to missing annotation (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: avoid false-positive lockdep splats in set walker (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: avoid false-positive lockdep splats with flowtables (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: avoid false-positive lockdep splats with sets (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: missing extended netlink error in lookup functions (Florian Westphal) [RHEL-236634]
- netfilter: nf_tables: avoid false-positive lockdep splat on rule deletion (Florian Westphal) [RHEL-236634]
- ALSA: timer: drain a slave's callback before its master detaches it (CKI Backport Bot) [RHEL-236081] {CVE-2026-68201}
- sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234304] {CVE-2026-64564}
- mac802154: llsec: add skb_cow_data() before in-place crypto (CKI Backport Bot) [RHEL-231022] {CVE-2026-63831}
- sctp: prevent peer transport count overflow (Xin Long) [RHEL-216251]
-
Mon Sep 21 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.50.1.el9_8]
- crypto: af_alg - Fix incorrect boolean values in af_alg_ctx (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964}
- crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg (CKI Backport Bot) [RHEL-264235] {CVE-2025-39964}
- mm/hugetlb: fix list corruption in allocate_file_region_entries() (Rafael Aquini) [RHEL-254487] {CVE-2026-74518}
- smb: client: fix multiuser mount with krb5 (Jorge San Emeterio Villalain) [RHEL-254108]
- net/mlx5e: macsec: fix use-after-free of metadata_dst on RX SC delete (Mohammad Heib) [RHEL-242927] {CVE-2026-72072}
- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-228484]
- iommu/vt-d: Fix race condition during PASID entry replacement (Eder Zulian) [RHEL-228484] {CVE-2026-45945}
- iommu/vt-d: Clear Present bit before tearing down context entry (Eder Zulian) [RHEL-228484] {CVE-2026-45944}
- iommu/vt-d: Clear Present bit before tearing down PASID entry (Eder Zulian) [RHEL-228484] {CVE-2026-45894}
- libceph: Reject monmaps advertising zero monitors (CKI Backport Bot) [RHEL-237896] {CVE-2026-68155}
- libceph: guard missing CRUSH type name lookup (CKI Backport Bot) [RHEL-237554] {CVE-2026-68157}
- libceph: refresh auth->authorizer_buf{,_len} after authorizer update (CKI Backport Bot) [RHEL-237486] {CVE-2026-68156}
- Bluetooth: RFCOMM: Fix session UAF in set_termios (CKI Backport Bot) [RHEL-237311] {CVE-2026-68188}
- Bluetooth: mgmt: hold reference for hci_conn in mgmt_pending_cmds (CKI Backport Bot) [RHEL-236850] {CVE-2026-68391}
- net/mlx5: Fix MCIA register buffer overflow on 32 dword reads (CKI Backport Bot) [RHEL-236791] {CVE-2026-68293}
- dm cache policy smq: check allocation under invalidate lock (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062}
- dm cache policy smq: fix missing locks in invalidating cache blocks (CKI Backport Bot) [RHEL-231819] {CVE-2026-53062}
- crypto: ccp - Fix a crash due to incorrect cleanup usage of kfree (CKI Backport Bot) [RHEL-230406] {CVE-2026-45959}
- keys: Pin request_key_auth payload in instantiate paths (CKI Backport Bot) [RHEL-225501] {CVE-2026-63823}
- ice: call netif_keep_dst() once when entering switchdev mode (Jakub Ramaseuski) [RHEL-213003]
- ice: fix ice_init_link() error return preventing probe (Jakub Ramaseuski) [RHEL-213003]
- ice: fix AQ error code comparison in ice_set_pauseparam() (Jakub Ramaseuski) [RHEL-213003]
- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Jakub Ramaseuski) [RHEL-213003]
- ice: dpll: fix memory leak in ice_dpll_init_info error paths (Jakub Ramaseuski) [RHEL-213003]
- ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Jakub Ramaseuski) [RHEL-213003]
- ice: remove redundant checks from PTP init (Jakub Ramaseuski) [RHEL-213003]
- ice: implement E825 TX ref clock control and TXC hardware sync status (Jakub Ramaseuski) [RHEL-213003]
- ice: add Tx reference clock index handling to AN restart command (Jakub Ramaseuski) [RHEL-213003]
- ice: implement CPI support for E825C (Jakub Ramaseuski) [RHEL-213003]
- ice: introduce TXC DPLL device and TX ref clock pin framework for E825 (Jakub Ramaseuski) [RHEL-213003]
- ice: fix missing priority callbacks for U.FL DPLL pins (Jakub Ramaseuski) [RHEL-213003]
- ice: restore PTP Rx timestamp config after ethtool set-channels (Jakub Ramaseuski) [RHEL-213003]
- ice: ptp: use primary NAC semaphore on E825 (Jakub Ramaseuski) [RHEL-213003]
- ice: ptp: serialize E825 PHY timer start with PTP lock (Jakub Ramaseuski) [RHEL-213003]
- ice: fix setting promisc mode while adding VID filter (Jakub Ramaseuski) [RHEL-213003]
- ice: fix VF queue configuration with low MTU values (Jakub Ramaseuski) [RHEL-213003]
- ice: fix locking around wait_event_interruptible_locked_irq (Jakub Ramaseuski) [RHEL-213003]
- ice: dpll: Fix compilation warning (Jakub Ramaseuski) [RHEL-213003]
- ice: mention fw_activate action along with devlink reload (Jakub Ramaseuski) [RHEL-213003]
- ice: dpll: fix misplaced header macros (Jakub Ramaseuski) [RHEL-213003]
- ice: dpll: fix rclk pin state get for E810 (Jakub Ramaseuski) [RHEL-213003]
- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Jakub Ramaseuski) [RHEL-213003]
- ice: fix locking in ice_dcb_rebuild() (Jakub Ramaseuski) [RHEL-213003]
- ice: fix setting RSS VSI hash for E830 (Jakub Ramaseuski) [RHEL-213003]
- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53007}
- ice: fix race condition in TX timestamp ring cleanup (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53008}
- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Jakub Ramaseuski) [RHEL-213003]
- ice: fix PHY config on media change with link-down-on-close (Jakub Ramaseuski) [RHEL-213003]
- ice: Fix memory leak in ice_set_ringparam() (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23389}
- ice: fix double-free of tx_buf skb (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-53009}
- ice: fix double free in ice_sf_eth_activate() error path (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-46162}
- ice: update PCS latency settings for E825 10G/25Gb modes (Jakub Ramaseuski) [RHEL-213003]
- ice: fix 'adjust' timer programming for E830 devices (Jakub Ramaseuski) [RHEL-213003]
- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Jakub Ramaseuski) [RHEL-213003]
- ice: ptp: don't WARN when controlling PF is unavailable (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-43346}
- ice: use ice_update_eth_stats() for representor stats (Jakub Ramaseuski) [RHEL-213003]
- ice: fix inverted ready check for VF representors (Jakub Ramaseuski) [RHEL-213003]
- drivers: net: ice: fix devlink parameters get without irdma (Jakub Ramaseuski) [RHEL-213003]
- ice: fix retry for AQ command 0x06EE (Jakub Ramaseuski) [RHEL-213003]
- ice: reintroduce retry mechanism for indirect AQ (Jakub Ramaseuski) [RHEL-213003]
- ice: fix adding AQ LLDP filter for VF (Jakub Ramaseuski) [RHEL-213003]
- ice: recap the VSI and QoS info after rebuild (Jakub Ramaseuski) [RHEL-213003]
- ice: stop counting UDP csum mismatch as rx_errors (Jakub Ramaseuski) [RHEL-213003]
- ice: convert all ring stats to u64_stats_t (Jakub Ramaseuski) [RHEL-213003]
- ice: shorten ring stat names and add accessors (Jakub Ramaseuski) [RHEL-213003]
- ice: use u64_stats API to access pkts/bytes in dim sample (Jakub Ramaseuski) [RHEL-213003]
- ice: remove ice_q_stats struct and use struct_group (Jakub Ramaseuski) [RHEL-213003]
- ice: pass pointer to ice_fetch_u64_stats_per_ring (Jakub Ramaseuski) [RHEL-213003]
- ice: unify PHY FW loading status handler for E800 devices (Jakub Ramaseuski) [RHEL-213003]
- ice: Make name member of struct ice_cgu_pin_desc const (Jakub Ramaseuski) [RHEL-213003]
- dpll: use pin owner's dpll ref for pin-level attribute reporting (Jakub Ramaseuski) [RHEL-213003]
- dpll: allow fwnode pins to attempt state change without capability bit (Jakub Ramaseuski) [RHEL-213003]
- dpll: extend pin notifier with notification source ID (Jakub Ramaseuski) [RHEL-213003]
- dpll: balance create/delete notifications in __dpll_pin_(un)register (Jakub Ramaseuski) [RHEL-213003]
- dpll: guard sync-pair removal on full pin unregister (Jakub Ramaseuski) [RHEL-213003]
- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003]
- dpll: send delete notification before unregister in on-pin rollback (Jakub Ramaseuski) [RHEL-213003]
- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Jakub Ramaseuski) [RHEL-213003]
- dpll: allow registering FW-identified pin with a different DPLL (Jakub Ramaseuski) [RHEL-213003]
- dpll: add generic DPLL type (Jakub Ramaseuski) [RHEL-213003]
- dpll: zl3073x: make frequency monitor a per-device attribute (Jakub Ramaseuski) [RHEL-213003]
- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-63977}
- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Jakub Ramaseuski) [RHEL-213003]
- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Jakub Ramaseuski) [RHEL-213003]
- dpll: zl3073x: fix memory leak on pin registration failure (Jakub Ramaseuski) [RHEL-213003]
- dpll: zl3073x: Use named initializers for struct i2c_device_id (Jakub Ramaseuski) [RHEL-213003]
- dpll: Prevent duplicate registrations (Jakub Ramaseuski) [RHEL-213003] {CVE-2026-23129}