-
Mon Oct 13 2025 Codrin Pruteanu <codrin.pruteanu@oracle.com> [5.14.0-570.52.1.0.1.el9_6.OL9]
- nvme-pci: remove two deallocate zeroes quirks [Orabug: 37756650]
- Disable UKI signing [Orabug: 36571828]
- Update Oracle Linux certificates (Kevin Lyons)
- Disable signing for aarch64 (Ilya Okomin)
- Oracle Linux RHCK Module Signing Key was added to the kernel trusted keys list (olkmod_signing_key.pem) [Orabug: 29539237]
- Update x509.genkey [Orabug: 24817676]
- Conflict with shim-ia32 and shim-x64 <= 15.3-1.0.5.el9
- Remove upstream reference during boot (Kevin Lyons) [Orabug: 34729535]
- Add Oracle Linux IMA certificates
- Add new Oracle Linux Driver Signing (key 1) certificate [Orabug: 37985764]
-
Sat Oct 04 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.52.1.el9_6]
- crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117232] {CVE-2023-53373}
- ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116186]
- hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-115069]
- net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-115069]
- net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-115069]
- net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-115069]
- net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-115069]
- net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-115069]
- hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Maxim Levitsky) [RHEL-115069]
- net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-115069]
- net: mana: Add support for Multi Vports on Bare metal (Maxim Levitsky) [RHEL-115069]
- net: mana: Switch to page pool for jumbo frames (Maxim Levitsky) [RHEL-115069]
- net: mana: Add metadata support for xdp mode (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: Handle net event for pointing to the current netdev (Maxim Levitsky) [RHEL-115069]
- net: mana: Change the function signature of mana_get_primary_netdev_rcu (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: Ensure variable err is initialized (Maxim Levitsky) [RHEL-115069]
- net: mana: Add debug logs in MANA network driver (Maxim Levitsky) [RHEL-115069]
- hv_netvsc: Use VF's tso_max_size value when data path is VF (Maxim Levitsky) [RHEL-115069]
- net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: request error CQEs when supported (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: Query feature_flags bitmask from FW (Maxim Levitsky) [RHEL-115069]
- net: mana: Support holes in device list reply msg (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: Allocate PAGE aligned doorbell index (Maxim Levitsky) [RHEL-115069]
- hv_netvsc: Link queues to NAPIs (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Maxim Levitsky) [RHEL-115069]
- RDMA/mana_ib: use the correct page table index based on hardware page size (Maxim Levitsky) [RHEL-115069]
- net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (Maxim Levitsky) [RHEL-115069]
- net: mana: Fix RX buf alloc_size alignment and atomic op panic (Maxim Levitsky) [RHEL-115069]
- ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CKI Backport Bot) [RHEL-114688] {CVE-2025-38729}
- ALSA: usb-audio: Fix size validation in convert_chmap_v3() (CKI Backport Bot) [RHEL-114688]
- ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114688] {CVE-2025-39757}
- HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
- HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
- HID: simplify snto32() (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
- eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111052] {CVE-2025-38614}
- smb: client: fix session setup against servers that require SPN (Paulo Alcantara) [RHEL-107109]
- smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-107109]
-
Sat Sep 27 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.51.1.el9_6]
- wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114705] {CVE-2025-39761}
- RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event (CKI Backport Bot) [RHEL-100798]
-
Thu Sep 25 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.50.1.el9_6]
- security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68092] {CVE-2024-50301}
- KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-104730] {CVE-2025-38351}
-
Tue Sep 23 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.49.1.el9_6]
- io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114335] {CVE-2025-39698}
- selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114326] {CVE-2025-39682}
- tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114326] {CVE-2025-39682}
-
Sat Sep 20 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.48.1.el9_6]
- perf trace: Add missing perf_tool__init() (Michael Petlan) [RHEL-105393]
- ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-114962]
- ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-114962]
-
Thu Sep 18 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.47.1.el9_6]
- tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113916]
- sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113333] {CVE-2025-38718}
- ice: fix max values for dpll pin phase adjust (Petr Oros) [RHEL-113039]
- ice/ptp: fix crosstimestamp reporting (Petr Oros) [RHEL-112558]
- ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-112873]
- ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-112873]
- ice: Implement PTP support for E830 devices (Petr Oros) [RHEL-112558]
- ice: Refactor ice_ptp_init_tx_* (Petr Oros) [RHEL-112558]
- ice: Add unified ice_capture_crosststamp (Petr Oros) [RHEL-112558]
- ice: Process TSYN IRQ in a separate function (Petr Oros) [RHEL-112558]
- ice: Use FIELD_PREP for timestamp values (Petr Oros) [RHEL-112558]
- ice: Remove unnecessary ice_is_e8xx() functions (Petr Oros) [RHEL-112558]
- ice: Don't check device type when checking GNSS presence (Petr Oros) [RHEL-112558]
- ice: Add in/out PTP pin delays (Petr Oros) [RHEL-112558]
- ice: fix PHY timestamp extraction for ETH56G (Petr Oros) [RHEL-112558]
- ice: Add correct PHY lane assignment (Petr Oros) [RHEL-112683]
- ice: Fix ETH56G FC-FEC Rx offset value (Petr Oros) [RHEL-112683]
- ice: Fix quad registers read on E825 (Petr Oros) [RHEL-112683]
- ice: Fix E825 initialization (Petr Oros) [RHEL-112683]
- tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-82136]
- smb: client: fix use-after-free in cifs_oplock_break (CKI Backport Bot) [RHEL-111196] {CVE-2025-38527}
- i40e: When removing VF MAC filters, only check PF-set MAC (CKI Backport Bot) [RHEL-109571]
- cpufreq/cppc: Don't compare desired_perf in target() (Mark Langsdorf) [RHEL-109525]
- netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CKI Backport Bot) [RHEL-106432] {CVE-2025-38472}
- sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-91800]
-
Tue Sep 16 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.46.1.el9_6]
- net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112246] {CVE-2023-53125}
- net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112246] {CVE-2023-53125}
- s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113558] {CVE-2025-39694}
- use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107301] {CVE-2025-38498}
- do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107301] {CVE-2025-38498}
- usb: dwc3: gadget: check that event count does not exceed event buffer length (CKI Backport Bot) [RHEL-107649] {CVE-2025-37810}
-
Sat Sep 13 2025 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.45.1.el9_6]
- tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Adrian Moreno) [RHEL-113279]
- igc: fix lock order in igc_ptp_reset (CKI Backport Bot) [RHEL-108118]
- igc: add lock preventing multiple simultaneous PTM transactions (CKI Backport Bot) [RHEL-108118]
- igc: cleanup PTP module if probe fails (CKI Backport Bot) [RHEL-108118]
- igc: handle the IGC_PTP_ENABLED flag correctly (CKI Backport Bot) [RHEL-108118]
- igc: move ktime snapshot into PTM retry loop (CKI Backport Bot) [RHEL-108118]
- igc: increase wait time before retrying PTM (CKI Backport Bot) [RHEL-108118]
- igc: fix PTM cycle trigger logic (CKI Backport Bot) [RHEL-108118]
- ice: use fixed adapter index for E825C embedded devices (CKI Backport Bot) [RHEL-111766]
- ice: use DSN instead of PCI BDF for ice_adapter index (CKI Backport Bot) [RHEL-111766]
-
Tue Sep 09 2025 Chao YE <cye@redhat.com> [5.14.0-570.44.1.el9_6]
- ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CKI Backport Bot) [RHEL-111149] {CVE-2025-38550}
- posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112780] {CVE-2025-38352}
- powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (CKI Backport Bot) [RHEL-113173]