# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> - 20260107-21
changelog:
  - Update linux-firmware to latest upstream (RHEL-119866)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - qcom: Update aic100 firmware files
  - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105
  - firmware: Revert kernel_boot.elf due to license compliance issue
  - linux-firmware: add firmware for an8811hb 2.5G ethernet phy
  - i915: Xe3LPD_3002 DMC v2.28
  - i915: Xe3LPD DMC v2.33
  - intel_vpu: Add firmware for 50xx NPUs and update older ones
  - linux-firmware: Update AMD SEV firmware
  - amdgpu: DMCUB updates for various ASICs
  - qcom: venus-5.4: fix ELF segment alignment to 4 bytes
  - mediatek MT7925: update bluetooth firmware to 20251210093205
  - linux-firmware: update firmware for MT7925 WiFi device
  - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller
  - qcom: Update CDSP firmware for qcm6490 platform
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55
  - linux-firmware: Add firmware file for Intel Scorpius core
  - rtw89: 8852b: update fw to v0.29.29.15
  - cirrus: cs35l41: Update firmware and tuning for various HP laptops
  - cirrus: cs35l41: Add support for new HP Clipper laptop
  - qcom: drop compatibility a640_zap.mdt symlink
  - qcom: add version for a530v3_gpmu.fw2
  - xe: Update GUC to v70.55.3 for BMG, PTL
  - iwlwifi: add Bz/Sc FW for core101-82 release
  - iwlwifi: Add Sc/Gf firmware for core101-82 release
  - iwlwifi: update ty/So/Ma firmwares for core101-82 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release
  - amdgpu: DMCUB updates for various ASICs
  - qcom: Add firmwares for sm8150 GPU
  - qcom: Add firmwares for sm8450 GPU
  - qcom: Add firmwares for sm8550 GPU
  - qcom: Add firmwares for sm8650 GPU
  - qcom: Add firmwares for sm8750 GPU
  - Makefile: add licence header
  - ath10k: WCN3990 hw1.0: update board-2.bin
  - ath10k: QCA9888 hw2.0: update board-2.bin
  - ath10k: QCA4019 hw1.0: update board-2.bin
  - cirrus: cs35l41: Add support for new HP laptops
  - Revert "amdgpu: update GC 11.5.0 firmware"
  - linux-firmware: Update amd-ucode copyright information
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - ath11k: QCA2066 hw2.1: update board-2.bin
  - qcom: update ADSP firmware for x1e80100 platform, change the license
  - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE
  - Reapply "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update GC 10.3.6 firmware"
  - Revert "amdgpu: update GC 11.5.1 firmware"
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20251124093155
  - intel_vpu: Update NPU firmware
  - WHENCE: fix version string for video firmware
  - qcom: vpu: update video firmware binary for SM8250
  - xe: Update GUC to v70.54.0 for BMG, PTL
  - Revert "amdgpu: update GC 11.0.1 firmware"
  - QCA: Add Bluetooth firmware for WCN685x uart interface
  - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3
  - qcom: venus-5.4: update firmware binary for v5.4
  - qcom: venus-5.4: remove unused firmware file
  - iwlwifi: add Sc/Wh FW for core98-181 release
  - amdgpu: DMCUB updates for various ASICs
  - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04
  - ASoC: tas2781: Add more symbol links on SPI devices
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update renoir firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update SMU 14.0.3 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update smu 13.0.0 kicker firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update SDMA 4.4.2 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: add vce1 firmware
  - mediatek MT7922: update bluetooth firmware to 20251118163447
  - linux-firmware: update firmware for MT7922 WiFi device
  - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license
  - qcom: add ADSP, CDSP firmware for sm8750 platform
  - rtl_nic: add firmware rtl9151a-1
  - qcom: Update aic100 firmware files
  - mt76: add firmware for MT7990
  - mt76: update firmware for MT7992
  - mt76: update firmware for MT7996
  - cirrus: cs35l57: Add firmware for a few Dell products
  - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec
  - qcom: Add sdx35 Foxconn vendor firmware image file
  - linux-firmware: Update AMD cpu microcode
  - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905
  Resolves: RHEL-119866


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260130-22
changelog:
  - Update linux-firmware to latest upstream (RHEL-145527)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
  - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops
  - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops
  - Intel IPU7: Update firmware binary for Panther Lake
  - linux-firmware: update firmware for MT7921 WiFi device
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F
  - linux-firmware: Add firmware for airoha-npu-7583 driver
  - iwlwifi: add Bz/Sc FW for core102-56 release
  - iwlwifi: Add Hr/Gf firmware for core102-56 release
  - iwlwifi: update ty/So/Ma firmwares for core102-56 release
  - xe: Add GSC 105.0.2.1301 for PTL
  - mediatek: rename MT8188 SCP firmware
  - qcom: Update DSP firmware for QCM6490 platform
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20260106153314
  - mediatek MT7920: update bluetooth firmware to 20260105151350
  - mediatek MT7922: update bluetooth firmware to 20260106153735
  - linux-firmware: update firmware for MT7922 WiFi device
  - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900
  - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0
  - qcom: Update DSP firmware for sa8775 platform
  - QCA: Add Bluetooth firmware for QCC2072 uart interface
  - i915: Xe3p_LPD DMC v2.33
  - qcom: Update DSP firmware for qcs8300 platform
  - linux-firmware: update firmware for MT7920 WiFi device
  Resolves: RHEL-145527


author: Packit <hello@packit.dev> - 350-1
changelog:
  - networking: fix renaming of bridges and other groups (RHEL-117883)
  - bridge: fix OpenSSH_10.2p1 host key detection


author: Alexander Sosedkin <asosedkin@redhat.com> - 20251126-1.git918f03d
changelog:
  - openssl: let TLS 1.3 brainpool groups get used for key shares
  - openssh: support mlkem768nistp256-sha256 and mlkem1024nistp384-sha384
  - FUTURE: disable non-PQ groups, keep ML-KEM only
  - sequoia: register "eddsa" as an alias to EDDSA-ED25519


author: Alexander Sosedkin <asosedkin@redhat.com> - 20260216-1.git0e54016
changelog:
  - FIPS: allow NIST hybrid kexes for openssh
  - libssh: enable NIST ML-KEM hybrids
  - libssh: add mlkem768x25519-sha256


author: Kristina Hanicova <khanicov@redhat.com> - 2.8.1-2
changelog:
  - patch: opal: Submit PSID reset command to R/W file descriptor.
  - patch: Read integrity profile info from top level device.
  - patch: Fix possible use of uninitialized variable.
  - patch: Reinstate pbkdf serialization flag in device activation.
  - patch: Fix LUKS2 device status in inline HW mode and detached header.
  - patch: Set inline integrity flag if no underlying dm-integrity device.
  - patch: Fix wrong device size status reports in cryptsetup and integritysetup.
  - Resolves: RHEL-122285 RHEL-125150 RHEL-125155 RHEL-125166 RHEL-132584 RHEL-140107


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-13
changelog:
  - RHEL-108945 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.4.10-15
changelog:
  - RHEL-129723 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129716 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-13
changelog:
  - Add 0035-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch
  - Add 0036-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch
  - Add 0037-libmpathpersist-check-released-key-against-the-reser.patch
  - Add 0038-multipathd-remove-thread-from-mpath_pr_event_handle.patch
  - Add 0039-libmpathpersist-remove-uneeded-wrapper-function.patch
  - Add 0040-libmpathpersist-reduce-log-level-for-persistent-rese.patch
  - Add 0041-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch
  - Add 0042-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch
  - Add 0043-libmpathpersist-limit-changing-prflag-in-update_map_.patch
  - Add 0044-multipathd-Don-t-call-update_map_pr-unnecessarily.patch
  - Add 0045-libmpathpersist-remove-useless-function-send_prout_a.patch
  - Add 0046-libmpathpersist-redesign-failed-release-workaround.patch
  - Add 0047-libmpathpersist-fail-the-release-if-all-threads-fail.patch
  - Add 0048-libmpathpersist-Handle-changing-key-corner-case.patch
  - Add 0049-libmpathpersist-Handle-REGISTER-AND-IGNORE-changing-.patch
  - Add 0050-libmultipath-rename-prflag_value-enums.patch
  - Add 0051-libmpathpersist-use-a-switch-statement-for-prout-com.patch
  - Add 0052-libmpathpersist-Add-safety-check-for-preempting-on-k.patch
  - Add 0053-libmpathpersist-remove-update_map_pr-code-for-NULL-p.patch
  - Add 0054-libmpathpersist-move-update_map_pr-to-multipathd.patch
  - Add 0055-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch
  - Add 0056-libmpathpersist-clean-up-duplicate-function-declarat.patch
  - Add 0057-multipathd-wrap-setting-and-unsetting-prflag.patch
  - Add 0058-multipathd-unregister-PR-key-when-path-is-restored-i.patch
  - Add 0059-libmpathpersist-Fix-up-reservation_key-checking.patch
  - Add 0060-libmpathpersist-change-how-reservation-conflicts-are.patch
  - Add 0061-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch
  - Add 0062-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch
  - Add 0063-libmpathpersist-Restore-old-reservation-key-on-failu.patch
  - Add 0064-libmpathpersist-update-reservation-key-before-checki.patch
  - Add 0065-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch
  - Add 0066-libmpathpersist-Don-t-always-fail-registrations-for-.patch
  - Add 0067-libmpathpersist-Don-t-try-release-workaround-for-inv.patch
  - Add 0068-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch
  - Add 0069-libmpathpersist-reregister-keys-when-self-preempting.patch
  - Add 0070-libmpathpersist-handle-updating-key-race-condition.patch
  - Add 0071-libmpathpersist-handle-preempting-all-registrants-re.patch
  - Add 0072-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch
  - Add 0073-libmpathpersist-Handle-RESERVE-with-reservation-held.patch
  - Add 0074-libmpathpersist-use-check_holding_reservation-in-mpa.patch
  - Add 0075-libmpathpersist-Fix-unregistering-while-holding-the-.patch
  - Add 0076-libmpathpersist-Fix-race-between-restoring-a-path-an.patch
  - Add 0077-multipathd-Fix-tracking-of-old-PR-key.patch
    * Fixes RHEL-118720 ("There are many bugs in multipath's persistent
      reservation handling [rhel-10]")
  - Resolves: RHEL-118720


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-14
changelog:
  - Add 0078-multipathd-Fix-race-while-registering-PR-key.patch
  - Add 0079-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch
    * Fixes RHEL-118720 ("There are many bugs in multipath's persistent
      reservation handling [rhel-10]")
  - Resolves: RHEL-118720


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-15
changelog:
  - Add 0080-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch
    * Fixes RHEL-128338 ("Update the multipath.conf stanza for Infinidat
      storage")
  - Resolves: RHEL-128338


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-16
changelog:
  - Add 0081-multipathd-make-multipathd-show-status-busy-checker-.patch
    * Fixes RHEL-136405 ("improve Busy checking for multipathd show status
      output")
  - Add 0082-multipathd-print-path-offline-message-even-without-a.patch
    * Fixes RHEL-133815 ("log_checker_err is not printing messages
      repeatedly for failed path [rhel-10]")
  - Resolves: RHEL-133815
  - Resolves: RHEL-136405


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-17
changelog:
  - Add 0083-libmultipath-add-purge_disconnected-configuration-op.patch
  - Add 0084-multipathd-implement-purge-functionality-for-disconn.patch
    * Fixes RHEL-141287 ("Add purge_disconnected support to multipathd")
  - Resolves: RHEL-141287


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.9.9-18
changelog:
  - Add 0085-libmpathpersist-fix-register-retry-status-checking.patch
  - Add 0086-multipathd-remember-number-of-registered-keys-when-i.patch
  - Add 0087-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch
    * Fixes RHEL-129442 ("Improve multipathd's handling of updating
      persistent reservations on restored paths.")
  - Resolves: RHEL-129442


author: Ales Matej <amatej@redhat.com> - 4.20.0-21
changelog:
  - autoremove: when a dangling protected dependency is found produce a warning
    and skip it (RHEL-128445)


author: Pavel Valena <pvalena@redhat.com> - 107-4
changelog:
  - fix(systemd-udevd): handle root=gpt-auto for systemd-v258
  - fix(systemd-repart): allow partition format
  - feat(install.d): do not remove UKIs on remove)
  - fix(dracut.install): remove extraneous quotes in dracut arguments
  - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded
    Resolves: RHEL-111580,RHEL-111709,RHEL-113071,RHEL-119787,RHEL-132571


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.6.1-1
changelog:
  - rebase to 5.6.1 (RHEL-132336)
    + Based on spec by Xavier Delaruelle in Fedora Rawhide.  Thanks a lot!


author: Arjun Shankar <arjun@redhat.com> - 2.39-111
changelog:
  - Sync with upstream branch release/2.39/master (RHEL-126766)	
  - Upstream commit: ce65d944e38a20cb70af2a48a4b8aa5d8fabe1cc	
  - posix: Reset wordexp_t fields with WRDE_REUSE (CVE-2025-15281 / BZ 33814)	
  - resolv: Fix NSS DNS backend for getnetbyaddr (CVE-2026-0915)	
  - memalign: reinstate alignment overflow check (CVE-2026-0861)	
  - support: Exit on consistency check failure in resolv_response_add_name	
  - support: Fix FILE * leak in check_for_unshare_hints in test-container	
  - sprof: fix -Wformat warnings on 32-bit hosts	
  - sprof: check pread size and offset for overflow	
  - getaddrinfo.c: Avoid uninitialized pointer access [BZ #32465]	
  - nptl: Optimize trylock for high cache contention workloads (BZ #33704)	
  - ppc64le: Power 10 rawmemchr clobbers v20 (bug #33091)	
  - ppc64le: Restore optimized strncmp for power10	
  - ppc64le: Restore optimized strcmp for power10	
  - AArch64: Optimise SVE scalar callbacks	
  - aarch64: fix includes in SME tests	
  - aarch64: fix cfi directives around __libc_arm_za_disable	
  - aarch64: tests for SME	
  - aarch64: clear ZA state of SME before clone and clone3 syscalls	
  - aarch64: define macro for calling __libc_arm_za_disable	
  - aarch64: update tests for SME	
  - aarch64: Disable ZA state of SME in setjmp and sigsetjmp	
  - linux: Also check pkey_get for ENOSYS on tst-pkey (BZ 31996)	
  - aarch64: Do not link conform tests with -Wl,-z,force-bti (bug 33601)	
  - x86: fix wmemset ifunc stray '!' (bug 33542)	
  - x86: Detect Intel Nova Lake Processor	
  - x86: Detect Intel Wildcat Lake Processor


author: Nicolas Frayer <nfrayer@redhat.com> - 2.12-38
changelog:
  - Fix several security issues about module unloading and file handling
  - Resolves: #RHEL-141581
  - Resolves: #CVE-2025-54770 #CVE-2025-54771 #CVE-2025-61661
  - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664


author: Josue Hernandez <josherna@redhat.com> 2.12-44
changelog:
  - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size
  - Resolves: #RHEL-148309


author: Josue Hernandez <josherna@redhat.com> - 2.12-29.3
changelog:
  - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size
  - Resolves: #RHEL-155287


author: Coiby Xu <coxu@redhat.com> - 1.6.2-4
changelog:
  - ima-setup: Use RSAHEADER to tell if a package has been signed
  - ima-setup: skip installing rpm-plugin-ima if it has been installed (RHEL-99356)
  - ima-setup: rebuild all initramfs images to include the integrity dracut module (RHEL-92638)


author: Tony Camuso <tcamuso@redhat.com> - 25.04-1
changelog:
  Clean up install paths, drop obsolete patches, and improve flag injection
  handling
  - Replaced hard-coded install paths in Makefiles with sed-based DESTDIR
    fixes for lib, pqos, rdtset, and membw
    - Using sed during %prep is more robust and version-agnostic than patching,
      which requires rebasing each release
  - Relocated admin tools (pqos*, rdtset) from /usr/bin to /usr/sbin for FHS
    compliance
    - These tools require root and interact with system-level cache controls
  - Updated %files to match SONAME bump (libpqos.so.5 -> libpqos.so.6) introduced
    upstream
  - Dropped patches 0001, 0002, 0004, 0005
    - 0001/0002 replaced by sed
    - 0004/0005 merged upstream
  - Replaced patch 0003 (CFLAGS/LDFLAGS override) with sed to convert assignments
    to +=
    - Ensures compatibility with distro-injected flags (e.g. -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Wno-complain-wrong-lang -Werror=format-security -Wp,-U_FORTIFY_SOURCE,-D_FORTIFY_SOURCE=3 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64-v3 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection -mtls-dialect=gnu2  ,
      hardening) without carrying a version-specific patch
    Resolves: RHEL-118205


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-209.el10]
changelog:
  - wifi: mt76: mt7925: disable auto regd changes after user set (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - wifi: mt76: mt7925: add auto regdomain switch support (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - wifi: mt76: mt7925: improve EHT capability control in regulatory flow (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - wifi: mt76: mt7925: refactor regulatory notifier flow (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - wifi: mt76: mt7925: refactor CLC support check flow (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - wifi: mt76: mt7925: refactor regulatory domain handling to regd.[ch] (Jose Ignacio Tornos Martinez) [RHEL-129847]
  - redhat: enabled configs for amd isp platform for x86 (Krzysztof Pawlinski) [RHEL-124085]
  - platform/x86: Update swnode graph for amd isp4 (Krzysztof Pawlinski) [RHEL-124085]
  - platform/x86: Use i2c adapter name to fix build errors (Krzysztof Pawlinski) [RHEL-124085]
  - platform/x86: Add AMD ISP platform config for OV05C10 (Krzysztof Pawlinski) [RHEL-124085]
  - redhat: enabled configs for amd isp on x86 (Krzysztof Pawlinski) [RHEL-124084]
  - i2c: I2C_DESIGNWARE_AMDISP should depend on DRM_AMD_ISP (Krzysztof Pawlinski) [RHEL-124084]
  - i2c: amd-isp: Initialize unique adapter name (Krzysztof Pawlinski) [RHEL-124084]
  - i2c: designware: Initialize adapter name only when not set (Krzysztof Pawlinski) [RHEL-124084]
  - i2c: amd-isp: Add ISP i2c-designware driver (Krzysztof Pawlinski) [RHEL-124084]
  - ALSA: update RHEL kconfigs for SoundWire upstream code (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: add name_prefix for rt1321 part id (Jaroslav Kysela) [RHEL-85740]
  - ASoC: tas2783: Fix build for SoundWire API update (Jaroslav Kysela) [RHEL-85740]
  - regmap: sdw-mbq: Don't assume the regmap device is the SoundWire slave (Jaroslav Kysela) [RHEL-85740]
  - soundwire: bus: fix off-by-one when allocating slave IDs (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: pcm: Set the PCM device name for HDMI (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add NO_DIRECT_COMPLETE flag to class driver (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: cs42l43: Enable Headphone pin for LINEOUT jack type (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc-acpi-intel-ptl-match: fix name_prefix of rt1320-2 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sof_sdw: Add a quirk for Lenovo laptop using sidecar amps with cs42l43 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56-test: Fix missing module namespace import (Jaroslav Kysela) [RHEL-85740]
  - soundwire: Add missing EXPORT for sdw_slave_type (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: remove dai registered check (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: Call init callbacks on the correct codec DAI (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc_sdw_utils: drop bogus container_of() error handling (Jaroslav Kysela) [RHEL-85740]
  - ASoC: intel: sof_sdw: Add codec_info for cs42l45 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: Move codec_name to dai info (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: soc_sdw_utils: convert to snd_soc_dapm_xxx() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc_sdw_utils: add cs35l57 support (Jaroslav Kysela) [RHEL-85740]
  - ASoC: tas2783A: sdw_utils: support ch 3 & 4 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: Add cs42l45 support functions (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: subtract the endpoint that is not present (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Fix incorrect select SND_SOC_CS35L56_CAL_SYSFS_COMMON (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc.h: Add SND_SOC_BYTES_E_ACC() to allow setting access flags (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc.h: Add SOC_ENUM_EXT_ACC() to allow setting access flags (Jaroslav Kysela) [RHEL-85740]
  - soundwire: dmi-quirks: add mapping for Avell B.ON (OEM rebranded of NUC15) (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc-acpi-intel-ptl-match: use aggregated endpoint in ptl_rt722_l0_rt1320_l23 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: soc-acpi-ptl-match: add cs42l43_agg_l3_cs35l56_2 support (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: soc-acpi-intel-ptl-match: Add support for rt722_l0_rt1320_l23 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L63 with feedback (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: soc-acpi-intel-mtl-match: Add 6 amp CS35L56 with feedback (Jaroslav Kysela) [RHEL-85740]
  - ASoc: tas2783A: acpi match for 4 channel for mtl (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc-acpi-intel-arl-match: change rt722 amp endpoint to aggregated (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: sof_sdw: shift SSP BT mask bits. (Jaroslav Kysela) [RHEL-85740]
  - ASoC: intel: sof_sdw: Add ability to have auxiliary devices (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sdw_utils: Add codec_conf for every DAI (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: sof_sdw: add codec speaker support for the SKU (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: sof_sdw: create BT dai link if bt_link_mask is set (Jaroslav Kysela) [RHEL-85740]
  - ASOC: Intel: sof_sdw: add quirk for Avell B.ON (OEM rebranded NUC15) (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: sof_sdw: Add quirk to exclude RT722 speaker (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: boards: fix HDMI playback lookup when HDMI-In capture used (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: topology: Add context when sink or source widget is missing (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc-acpi / SOF: Add best_effort flag to get_function_tplg_files op (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: ipc4-topology: set playback channel mask (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: ipc4-control: Keep the payload size up to date (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: ipc4-control: Use the correct size for scontrol->ipc_control_data (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: ipc4-control: If there is no data do not send bytes update (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Intel: pci-mtl: Change the topology path to intel/sof-ipc4-tplg (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Intel: hda: Only check SSP MCLK mask in case of IPC3 (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: mock_bin: Add function to create long-offset patches (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: mock_bin: Pass offset32 to cs_dsp_mock_bin_add_raw_block() (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Handle long-offset data blocks (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Remove __free() from cs_dsp_debugfs_string_read() (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Don't use __free() in cs_dsp_load() and cs_dsp_load_coeff() (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Don't require client to provide a struct cs_dsp_client_ops (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Take pwr_lock around reading controls debugfs (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Use kvzalloc() to allocate control caches (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Remove redundant download buffer allocator (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Store control length as 32-bit (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Append \n to debugfs string during read (Jaroslav Kysela) [RHEL-85740]
  - firmware: cs_dsp: Factor out common debugfs string read (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l45: Corrects ASP_TX5 DAPM widget channel (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Add KUnit testing of cs35l56_set_fw_suffix() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Use vendor-specific qualifier in firmware file search (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Log a message if firmware is missing (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Use SND_SOC_BYTES_E_ACC() for CAL_DATA_RB control (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Use SOC_ENUM_EXT_ACC() for CAL_SET_STATUS control (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Allow restoring factory calibration through ALSA control (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Create debugfs files for factory calibration (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Add control to read CAL_SET_STATUS (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Alter error codes for calibration routine (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Add calibration command to store into UEFI (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Add common code for factory calibration (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs35l56: Read silicon ID during initialization and save it (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Replace __free(kfree) with normal kfree() cleanup (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Add a Kconfig symbol for enabling test hooks (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Support Dell SSIDExV2 UEFI variable (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Add function to write calibration to UEFI (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib-test: Tests for reading SSIDExV2 (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib-test: Add test cases for cs_amp_set_efi_calibration_data() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Return attributes from cs_amp_get_efi_variable() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Add helpers for factory calibration (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib: Remove redundant calls to kunit_deactivate_static_stub() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: cs-amp-lib-test: Add cases for factory calibration helpers (Jaroslav Kysela) [RHEL-85740]
  - ACPICA: Add SoundWire File Table (SWFT) signature (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: functions: Fix confusing cleanup.h syntax (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Move most of the messages from info to debug (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Fix NULL vs IS_ERR() bug in sdca_dev_register_functions() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Correct FDL locking in sdca_fdl_process() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add companion amp Function (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Parse XU Entity properties (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add stubs for FDL helper functions (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add UMP timeout handling for FDL (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add completion for FDL start and stop (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add helper to write initialization writes (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Populate regmap cache for readable Controls (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Factor out helper to process Control defaults (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Force some SDCA Controls to be volatile (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add comment for function reset polling (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Allow sample width wild cards in set_usage() (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add terminal type into input/output widget name (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Align mute controls to ALSA expectations (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Fixup some more Kconfig issues (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add ASoC jack hookup in class driver (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add ability to connect SDCA jacks to ASoC jacks (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Factor out jack handling into new c file (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: add function devices (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add missing forward declaration in header (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add SDCA FDL data parsing (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Parse Function Reset max delay (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add lock to serialise the Function initialisation (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Device boot into the system suspend process (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add basic system suspend support (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add SDCA IRQ enable/disable helpers (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Use helper macros for control identification (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add HID button IRQ (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Pass SoundWire slave to HID (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add early IRQ handling (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add FDL-specific IRQ processing (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Rely less on the ASoC component in IRQ handling (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Factor out a helper to find SDCA IRQ data (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Update externally_requested flag to cover all requests (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Pass device register map from IRQ alloc to handlers (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add manual PM runtime gets to IRQ handlers (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Rename SoundWire struct device variables (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add basic SDCA function driver (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add basic SDCA class driver (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add FDL library for XU entities (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SDCA: Add UMP buffer helper functions (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Intel: remove hyphen from AMP<index> name_prexix (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Intel: add hyphen between name and index to amp name_prefix (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: don't check the existence of dummy topology (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Don't print the monolithic topology name if function topology may be used (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc-acpi: make some variables of acpi adr and link adr non-const (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc_sdw_utils: add name_prefix to asoc_sdw_codec_info struct (Jaroslav Kysela) [RHEL-85740]
  - ASoC: Intel: export sof_sdw_get_tplg_files (Jaroslav Kysela) [RHEL-85740]
  - ASoC: soc_sdw_utils: export asoc_sdw_get_dai_type (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: add platform name into sof_intel_dsp_desc (Jaroslav Kysela) [RHEL-85740]
  - ASoC: SOF: Intel: use sof_sdw as default SDW machine driver (Jaroslav Kysela) [RHEL-85740]
  - ASoC: sof-function-topology-lib: escalate the log when missing function topoplogy (Jaroslav Kysela) [RHEL-85740]
  - r8169: fix RTL8117 Wake-on-Lan in DASH mode (Izabela Bakollari) [RHEL-96436]
  - r8169: improve MAC EEE handling (Izabela Bakollari) [RHEL-96436]
  - r8169: add support for RTL9151A (Izabela Bakollari) [RHEL-96436]
  - r8169: bail out from probe if fiber mode is detected on RTL8127AF (Izabela Bakollari) [RHEL-96436]
  - r8169: add support for RTL8125K (Izabela Bakollari) [RHEL-96436]
  - r8169: reconfigure rx unconditionally before chip reset when resuming (Izabela Bakollari) [RHEL-96436]
  - eth: 8139too: Make 8139TOO_PIO depend on !NO_IOPORT_MAP (Izabela Bakollari) [RHEL-96436]
  - r8169: enable EEE at 5Gbps on RTL8126 (Izabela Bakollari) [RHEL-96436]
  - r8169: fix RTL8127 hang on suspend/shutdown (Izabela Bakollari) [RHEL-96436]
  - r8169: fix packet truncation after S4 resume on RTL8168H/RTL8111H (Izabela Bakollari) [RHEL-96436]
  - r8169: set EEE speed down ratio to 1 (Izabela Bakollari) [RHEL-96436]
  - r8169: log that system vendor flags ASPM as safe (Izabela Bakollari) [RHEL-96436]
  - r8169: remove redundant pci_tbl entry (Izabela Bakollari) [RHEL-96436]
  - r8169: add support for RTL8127A (Izabela Bakollari) [RHEL-96436]
  - r8169: merge chip versions 52 and 53 (RTL8117) (Izabela Bakollari) [RHEL-96436]
  - r8169: merge chip versions 64 and 65 (RTL8125D) (Izabela Bakollari) [RHEL-96436]
  - r8169: merge chip versions 70 and 71 (RTL8126A) (Izabela Bakollari) [RHEL-96436]
  - r8169: refactor chip version detection (Izabela Bakollari) [RHEL-96436]
  - r8169: use pci_prepare_to_sleep in rtl_shutdown (Izabela Bakollari) [RHEL-96436]
  - r8169: add RTL_GIGA_MAC_VER_LAST to facilitate adding support for new chip versions (Izabela Bakollari) [RHEL-96436]
  - r8169: add helper rtl8125_phy_param (Izabela Bakollari) [RHEL-96436]
  - r8169: add helper rtl_csi_mod for accessing extended config space (Izabela Bakollari) [RHEL-96436]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-210.el10]
changelog:
  - gpio: tegra186: Fix GPIO name collisions for Tegra410 (Jennifer Berringer) [RHEL-135122]
  - gpio: tegra186: Add support for Tegra410 (Jennifer Berringer) [RHEL-135122]
  - gpio: tegra186: Use generic macro for port definitions (Jennifer Berringer) [RHEL-135122]
  - gpio: tegra186: Add support for Tegra256 (Jennifer Berringer) [RHEL-135122]
  - dt-bindings: gpio: Add Tegra256 support (Jennifer Berringer) [RHEL-135122]
  - gpio: tegra186: fix resource handling in ACPI probe path (Jennifer Berringer) [RHEL-135122]
  - perf/arm_cspmu: nvidia: Add pmevfiltr2 support (Charles Mirabile) [RHEL-121677]
  - perf/arm_cspmu: nvidia: Add revision id matching (Charles Mirabile) [RHEL-121677]
  - perf/arm_cspmu: Add pmpidr support (Charles Mirabile) [RHEL-121677]
  - perf/arm_cspmu: Add callback to reset filter config (Charles Mirabile) [RHEL-121677]
  - tools headers arm64: Add NVIDIA Olympus part (Charles Mirabile) [RHEL-138474]
  - perf arm-spe: Add NVIDIA Olympus to neoverse list (Charles Mirabile) [RHEL-138474]
  - bpf: Fix bpf_xdp_store_bytes proto for read-only arg (Felix Maurer) [RHEL-133468]
  - bpf: Fix invalid prog->stats access when update_effective_progs fails (Felix Maurer) [RHEL-133468]
  - bpf/arm64: Fix BPF_ST into arena memory (Felix Maurer) [RHEL-133468]
  - xsk: Harden userspace-supplied xdp_desc validation (Felix Maurer) [RHEL-133468]
  - bpf, cpumap: Disable page_pool direct xdp_return need larger scope (Felix Maurer) [RHEL-133468]
  - bpf, sockmap: Fix panic when calling skb_linearize (Felix Maurer) [RHEL-133468]
  - bpf, sockmap: fix duplicated data transmission (Felix Maurer) [RHEL-133468]
  - xsk: Fix race condition in AF_XDP generic RX path (Felix Maurer) [RHEL-133468]
  - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144130] {CVE-2026-23001}
  - soc/tegra: fuse: Do not register SoC device on ACPI boot (Jennifer Berringer) [RHEL-135124]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-136089]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.el10]
changelog:
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-150361]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-150361]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.1.1.el10_2]
changelog:
  - vsock: document write-once behavior of the child_ns_mode sysctl (Stefano Garzarella) [RHEL-151754]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-151754]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-151754]
  - vsock: document namespace mode sysctls (Stefano Garzarella) [RHEL-151754]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148483]
  - ice: dpll: fix rclk pin state get and misplaced header macros (Ivan Vecera) [RHEL-146369]
  - ice: dpll: Support E825-C SyncE and dynamic pin discovery (Ivan Vecera) [RHEL-146369]
  - drivers: Add support for DPLL reference count tracking (Ivan Vecera) [RHEL-146369]
  - redhat: configs: Enable CONFIG_DPLL_REFCNT_TRACKER for debug (Ivan Vecera) [RHEL-146369]
  - dpll: Add reference count tracking support (Ivan Vecera) [RHEL-146369]
  - dpll: Enhance and consolidate reference counting logic (Ivan Vecera) [RHEL-146369]
  - dpll: zl3073x: Add support for mux pin type (Ivan Vecera) [RHEL-146369]
  - dpll: Support dynamic pin index allocation (Ivan Vecera) [RHEL-146369]
  - dpll: Add notifier chain for dpll events (Ivan Vecera) [RHEL-146369]
  - dpll: zl3073x: Associate pin with fwnode handle (Ivan Vecera) [RHEL-146369]
  - dpll: Allow associating dpll pin with a firmware node (Ivan Vecera) [RHEL-146369]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-146257]
  - redhat: set defaults for RHEL 10.2 (Scott Weaver)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.2.1.el10_2]
changelog:
  - selftests: kvm: Verify TILELOADD actually #NM faults when XFD[18]=1 (Maxim Levitsky) [RHEL-148618]
  - selftests: kvm: try getting XFD and XSAVE state out of sync (Maxim Levitsky) [RHEL-148618]
  - selftests: kvm: replace numbered sync points with actions (Maxim Levitsky) [RHEL-148618]
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Maxim Levitsky) [RHEL-148618]
  - KVM: selftests: Add ex_str() to print human friendly name of exception vectors (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Define AMD's #HV, #VC, and #SX exception vectors (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Define Control Protection Exception (#CP) vector (Maxim Levitsky) [RHEL-148618]
  - KVM: x86: Add human friendly formatting for #XM, and #VE (Maxim Levitsky) [RHEL-148618]
  - KVM: selftests: Add support for #DE exception fixup (Maxim Levitsky) [RHEL-148618]
  - idpf: export RX hardware timestamping information to XDP (Michal Schmidt) [RHEL-136674]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.3.1.el10_2]
changelog:
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - redhat/configs: enable keyboard GPIO for x86 (Mark Langsdorf) [RHEL-147908]
  - redhat/configs: enable CONFIG_INPUT_SOC_BUTTON_ARRAY on x86 (Mark Langsdorf) [RHEL-135367]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-145800]
  - selftests/bpf: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714]
  - bpf: crypto: Use the correct destructor kfunc type (Viktor Malik) [RHEL-113714]
  - PCI: vmd: Override irq_startup()/irq_shutdown() in vmd_init_dev_msi_info() (Myron Stowe) [RHEL-143521]
  - PCI: vmd: Add VMD Device ID Support for Panther Lake (PTL)-H/P/U (Myron Stowe) [RHEL-143521]
  - net: vlan: don't propagate flags on open (Hangbin Liu) [RHEL-149691]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.4.1.el10_2]
changelog:
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (Michal Schmidt) [RHEL-155353]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120700]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Florian Westphal) [RHEL-153273] {CVE-2026-23231}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149753] {CVE-2026-23111}
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150231]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150231] {CVE-2026-23209}
  - smb: client: fix broken multichannel with krb5+signing (Paulo Alcantara) [RHEL-152652]
  - smb: client: fix regression with signing (Paulo Alcantara) [RHEL-152652]
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145815]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145815]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147272] {CVE-2026-23097}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.5.1.el10_2]
changelog:
  - efivarfs: fix error propagation in efivar_entry_get() (CKI Backport Bot) [RHEL-150117] {CVE-2026-23156}
  - powerpc, perf: Check that current->mm is alive before getting user callchain (Michael Petlan) [RHEL-145265]
  - accel/qaic: enable drivers/accel/qaic configuration in RHEL. (John Wiele) [RHEL-149722]
  - accel/qaic: Merge from upstream v6.18..v6.19 (John Wiele) [RHEL-149722]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155461]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155461]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155461]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155461]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155461]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155461]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150249] {CVE-2026-23210}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150408] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150408]
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Rafael Aquini) [RHEL-150482] {CVE-2026-23144}
  - arch_topology: Provide a stub topology_core_has_smt() for !CONFIG_GENERIC_ARCH_TOPOLOGY (Charles Mirabile) [RHEL-143323]
  - perf: arm_pmuv3: Don't use PMCCNTR_EL0 on SMT cores (Charles Mirabile) [RHEL-143323]
  - mshv: handle gpa intercepts for arm64 (Paolo Bonzini) [RHEL-146632]
  - mshv: add definitions for arm64 gpa intercepts (Paolo Bonzini) [RHEL-146632]
  - mshv: Add __user attribute to argument passed to access_ok() (Paolo Bonzini) [RHEL-146632]
  - mshv: Store the result of vfs_poll in a variable of type __poll_t (Paolo Bonzini) [RHEL-146632]
  - mshv: Align huge page stride with guest mapping (Paolo Bonzini) [RHEL-146632]
  - mshv: release mutex on region invalidation failure (Paolo Bonzini) [RHEL-146632]
  - mshv: hide x86-specific functions on arm64 (Paolo Bonzini) [RHEL-146632]
  - mshv: Initialize local variables early upon region invalidation (Paolo Bonzini) [RHEL-146632]
  - mshv: Use PMD_ORDER instead of HPAGE_PMD_ORDER when processing regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Cleanly shutdown root partition with MSHV (Paolo Bonzini) [RHEL-146632]
  - mshv: Use reboot notifier to configure sleep state (Paolo Bonzini) [RHEL-146632]
  - mshv: Add definitions for MSHV sleep state configuration (Paolo Bonzini) [RHEL-146632]
  - mshv: Add support for movable memory regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Add refcount and locking to mem regions (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix huge page handling in memory region traversal (Paolo Bonzini) [RHEL-146632]
  - mshv: Move region management to mshv_regions.c (Paolo Bonzini) [RHEL-146632]
  - mshv: Centralize guest memory region destruction (Paolo Bonzini) [RHEL-146632]
  - mshv: Refactor and rename memory region handling functions (Paolo Bonzini) [RHEL-146632]
  - mshv: adjust interrupt control structure for ARM64 (Paolo Bonzini) [RHEL-146632]
  - mshv: Add ioctl for self targeted passthrough hvcalls (Paolo Bonzini) [RHEL-146632]
  - mshv: Extend create partition ioctl to support cpu features (Paolo Bonzini) [RHEL-146632]
  - mshv: Allow mappings that overlap in uaddr (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix create memory region overlap check (Paolo Bonzini) [RHEL-146632]
  - mshv: add WQ_PERCPU to alloc_workqueue users (Paolo Bonzini) [RHEL-146632]
  - hyperv: Add two new hypercall numbers to guest ABI public header (Paolo Bonzini) [RHEL-146632]
  - mshv: Introduce new hypercall to map stats page for L1VH partitions (Paolo Bonzini) [RHEL-146632]
  - mshv: Allocate vp state page for HVCALL_MAP_VP_STATE_PAGE on L1VH (Paolo Bonzini) [RHEL-146632]
  - mshv: Get the vmm capabilities offered by the hypervisor (Paolo Bonzini) [RHEL-146632]
  - mshv: Add the HVCALL_GET_PARTITION_PROPERTY_EX hypercall (Paolo Bonzini) [RHEL-146632]
  - mshv: Only map vp->vp_stats_pages if on root scheduler (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix deposit memory in MSHV_ROOT_HVCALL (Paolo Bonzini) [RHEL-146632]
  - mshv: Fix VpRootDispatchThreadBlocked value (Paolo Bonzini) [RHEL-146632]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.6.1.el10_2]
changelog:
  - allow finish_no_open(file, ERR_PTR(-E...)) (Roberto Bergantinos Corpas) [RHEL-155441]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156881] {CVE-2026-23243}
  - iavf: fix incorrect reset handling in callbacks (Petr Oros) [RHEL-142546]
  - IB/IPoIB: Add support for hwtstamp get/set ndos (CKI Backport Bot) [RHEL-154278]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148654] {CVE-2026-23040}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145936]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145936]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.7.1.el10_2]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153673]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153673]
  - platform/mellanox: mlxbf-pmc: add sysfs_attr_init() to count_clock init (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Use kstrtobool() to check 0/1 input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Validate event/enable input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Remove newline char from event name input (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Fix duplicate event ID for CACHE_DATA1 (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Support additional PMC blocks (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Add support for clock_measure performance block (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: Add support for monitoring cycle count (David Thompson) [RHEL-104053]
  - platform/mellanox: mlxbf-pmc: incorrect type in assignment (David Thompson) [RHEL-104053]
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112270]
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154415]
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154415]
  - bonding: fix use-after-free due to enslave fail after slave array update (Hangbin Liu) [RHEL-152392] {CVE-2026-23171}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150133] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.50.1.el10_1]
changelog:
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159225] {CVE-2025-68741}
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-150573]
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154414]
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154414]
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-154414]
  - cifs: make retry logic in read/write path consistent with other paths (Paulo Alcantara) [RHEL-154414]
  - cifs: on replayable errors back-off before replay, not after (Paulo Alcantara) [RHEL-154414]
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara) [RHEL-154414]
  - smb/client: fix memory leak in smb2_open_file() (Paulo Alcantara) [RHEL-154414]
  - netfs: avoid double increment of retry_count in subreq (Paulo Alcantara) [RHEL-154414]
  - netfs: when subreq is marked for retry, do not check if it faced an error (Paulo Alcantara) [RHEL-154414]
  - netfs: Fix early read unlock of page with EOF in middle (Paulo Alcantara) [RHEL-154414]
  - netfs: fix reference leak (Paulo Alcantara) [RHEL-154414]
  - netfs: Prevent duplicate unlocking (Paulo Alcantara) [RHEL-154414]
  - netfs: Fix unbuffered write error handling (Paulo Alcantara) [RHEL-154414]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150451] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150451] {CVE-2025-39766}
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-142607]
  - iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144317]
  - iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144317]
  - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141694]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.53.1.el10_1]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167019] {CVE-2026-31402}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.54.1.el10_1]
changelog:
  - thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-108357]
  - thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-108357]
  - thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-108357]
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168071] {CVE-2026-31419}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157330] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.55.1.el10_1]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172211]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172211]
  - crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172211]
  - crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172211]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172211] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172211] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172211]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172211] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172211] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172211]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-124.56.1.el10_1]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174548] {CVE-2026-43284}


author: Rado Vrbovsky <rvrbovsk@redhat.com> 0.9.7-20
changelog:
  - Rebase kpatch with upstream to v0.9.10 (RHEL-113127)
  - Provide a list of CVEs currently patched using live patches (RHEL-106283)


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.4-100
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114545 - Update to version 4.23.4
  - resolves: RHEL-132338 - Fix Time Machine backup
  - resolves: RHEL-132975 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 2:4.23.5-100
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-138263 - Fix winbind group resolution
  - resolves: RHEL-141012 - Fix winbind crash


author: Siddhesh Poyarekar <siddhesh@redhat.com> - 14.3.1-4
changelog:
  - update from releases/gcc-14 branch
    - PRs ada/107536, ada/113536, analyzer/118300, c/122188, c++/120620,
  	c++/120757, c++/121801, c++/121977, c++/121981, fortran/89092,
  	fortran/120784, fortran/121145, fortran/121263, go/104290,
  	libstdc++/110853, libstdc++/117276, libstdc++/120698,
  	libstdc++/121097, libstdc++/121374, libstdc++/121496,
  	libstdc++/121745, libstdc++/121827, libstdc++/122168,
  	libstdc++/122322, middle-end/121453, middle-end/121828, other/118919,
  	rtl-optimization/121253, target/49857, target/81540, target/118280,
  	target/120442, target/120476, target/120691, target/121118,
  	target/121208, target/121294, target/121414, target/121449,
  	target/121542, target/121599, target/121608, target/121749,
  	target/122177, target/122187, target/122210, target/122220,
  	target/122222, testsuite/118567, tree-optimization/117423,
  	tree-optimization/119085, tree-optimization/120357,
  	tree-optimization/120358, tree-optimization/120654,
  	tree-optimization/120817, tree-optimization/120944,
  	tree-optimization/121059, tree-optimization/121256,
  	tree-optimization/121370, tree-optimization/121772,
  	tree-optimization/121870, tree-optimization/122104


author: Joseph Myers <josmyers@redhat.com> - 14.3.1-4.1
changelog:
  - fixes for testing non-production cross compilers (RHEL-114521)
    - include libstdc++fs.a and libstdc++exp.a in sysroot packages
    - add libsanitizer sysroot packages
    - save testsuite .sum files in build logs
    - add packages with files from build tree used in testsuite
    - escape \r in dg-regexp test names to avoid truncation in build-tree testing
    - fix iconv linking for installed testing
    - enable compat testing for installed testing
    - distinguish canonical and noncanonical target for installed testing
    - add plugin headers packages for cross compilers
    - install text-art/*.h plugin headers
    - support plugin tests for installed testing


author: Joseph Myers <josmyers@redhat.com> - 14.3.1-4.2
changelog:
  - fixes for testing non-production cross compilers (RHEL-114521)
    - enable stack-protector tests in cross testing


author: Joseph Myers <josmyers@redhat.com> - 14.3.1-4.3
changelog:
  - fixes for testing non-production cross compilers (RHEL-114521)
    - enable guality tests in cross testing
    - enable simulate-thread tests in cross testing
    - enable gcov tests in cross testing
    - enable some miscellaneous tests in cross testing
    - fix some tree-prof tests for cross testing


author: Joseph Myers <josmyers@redhat.com> - 14.3.1-4.4
changelog:
  - fixes for testing non-production cross compilers (RHEL-114521)
    - include libsanitizer.spec and static sanitizer libraries in packages
    - enable tests involving target environment variables in cross testing
    - disable color for more sanitizer tests


author: Karel Zak <kzak@redhat.com> - 2.40.2-14
changelog:
  - lscpu: Add NVIDIA Olympus arm64 core
  - libfdisk: improve collision reporting
  - libfdisk: (dos) ignore incomplete EBR for non-wholedisk
  - wall: always use utmp as fallback


author: Karel Zak <kzak@redhat.com> - 2.40.2-15
changelog:
  - mount: improve --all documentation
  - libblkid: Fix probe_ioctl_tp assigning BLKGETDISKSEQ as physical
  - libblkid: use snprintf() instead of sprintf()


author: Ales Matej <amatej@redhat.com> - 0.73.1-14
changelog:
  - Mark all protected packages as user installed for all transactions (RHEL-128445)
  - Add `filterUnneededExtraUserinstalled` and Python version to the API
  - Describe all problems even when there are protected removals (RHEL-146507)
  - Clearer error for protected package broken dependencies


author: Jiri Hnidek <jhnidek@redhat.com> 1.30.11-1
changelog:
  - fix: Do not send JSON document with empty signature (jhnidek@redhat.com)
  - Translated using Weblate (Czech) (pavel.borecki@gmail.com)
  - Translated using Weblate (Czech) (jhnidek@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - Translated using Weblate (Czech) (pavel.borecki@gmail.com)
  - Translated using Weblate (Czech) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Added translation using Weblate (Czech) (pavel.borecki@gmail.com)
  - chore: Make new black happy again (jhnidek@redhat.com)
  - chore: Increased log level of messages (jhnidek@redhat.com)
  - fix: Use IMDSv2 for signature first (jhnidek@redhat.com)
  - ci: bump actions/upload-artifact from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)
  - chore: Removed getSyspurposeCompliance (jhnidek@redhat.com)
  - chore: Do not call candlepin from GetSyspurposeStatus (jhnidek@redhat.com)
  - chore: Removed SyspurposeComplianceStatusCache (jhnidek@redhat.com)
  - fix: Require findutils in .spec file (jhnidek@redhat.com)
  - feat: Try to cache candlepin server capabilities (jhnidek@redhat.com)
  - solved a conflict in utils.py (jstavel@redhat.com)
  - CCT-744: integration tests for DBus Config object (jstavel@redhat.com)
  - CCT-1029: tests for Register with environment option (jstavel@redhat.com)
  - chore: Small changes in integration-tests/test_syspurpose.py
    (jhnidek@redhat.com)
  - chore: Small fixes in test_register_get_orgs.py (jhnidek@redhat.com)
  - chore: Small fixes of integration-tests/test_register.py (jhnidek@redhat.com)
  - chore: Small tweaks of bash script of integration tests (jhnidek@redhat.com)
  - chore(doc): Improved README.md for integration tests (jhnidek@redhat.com)
  - CCT-743: rebased (jstavel@redhat.com)
  - CCT-1600: fix applied, unified settings.toml to use the same name of
    valid_fields.json (jstavel@redhat.com)
  - ci: bump actions/checkout from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)
  - CCT-742: integration tests for DBus Syspurpose object (jstavel@redhat.com)
  - CCT-1029: test for dbus method GetEnvironments (jstavel@redhat.com)
  - CCT-1097: added enable_content for registration tests (jstavel@redhat.com)
  - CCT-745: multi org credentials added (jstavel@redhat.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.30.12-1
changelog:
  - feat: Added more debug prints to cloud-what (jhnidek@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Added translation using Weblate (Finnish) (noreply-addon-
    languages@weblate.org)
  - Translated using Weblate (Czech) (jsefler@redhat.com)
  - fix(test): Fix unit tests of "sub-man status" (jhnidek@redhat.com)
  - RHEL-126153: Update GCP to Google Cloud in log messages (crag@redhat.com)
  - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com)
  - ci: bump actions/upload-artifact from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Fix profile upload because of missing self.cp (suttner@atix.de)
  - feat: added signature type log in TLS handshake (macano@redhat.com)
  - feat: added internal method to get tls handshake info
    (manuelcanorojo@gmail.com)
  - fix: Print list of environments without --set/--list (jhnidek@redhat.com)
  - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com)
  - fix(test): Fix unit test of aws (jhnidek@redhat.com)
  - fix(ci): Fixed integration tests of syspurpose (jhnidek@redhat.com)
  - chore: Removed deprecated information from setup.py (jhnidek@redhat.com)
  - chore(ci): Specify permissions for Actions (mhorky@redhat.com)
  - feat: check if --set arg is empty when the environments module is called
    (manuelcanorojo@gmail.com)
  - docs: added missing gettext building dependency (manuelcanorojo@gmail.com)
  - docs: improved man content related to subscription-manager environment
    variables for proxy configuration (manuelcanorojo@gmail.com)
  - ci: bump actions/checkout from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Fix gobject python package name of sles (suttner@atix.de)
  - Fix SLES build on OBS (suttner@atix.de)


author: Sumit Bose <sbose@redhat.com> - 2.12.0-1
changelog:
  - Resolves: RHEL-139110 - Rebase SSSD for RHEL 10.2
  - Resolves: RHEL-132552 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so[7f6fd25ae000+4d000]
  - Resolves: RHEL-132505 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-130571 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-129636 - sssd service fails to start after updating to 2.9.6-4 or 2.9.7-4
  - Resolves: RHEL-128594 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name
  - Resolves: RHEL-127792 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-120501 - Crash in 'sss_client/autofs/sss_autofs.c'
  - Resolves: RHEL-120287 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux systems [rhel-10.2]
  - Resolves: RHEL-114468 - Spam in 'sssd_kcm.log' during normal operations
  - Resolves: RHEL-113111 - Including innapropriate IPv6 addresses in dyndns_update
  - Resolves: RHEL-104221 - The SSSD cache is filled with groups having GID=0, causing the cache index to grow excessively large. This, in turn, leads to timeouts
  - Resolves: RHEL-94545 - When the user name of an AD user in an IPA-AD trust environment overwritten, the user private group, the users primary group, cannot be lookup up by the overwritten name.
  - Resolves: RHEL-77184 - AD user in external group is not cleared when expiring the cache
  - Resolves: RHEL-72935 - sss_override does not work on AD UPN
  - Resolves: RHEL-11913 - GDM Support for IdM IdP feature and MFA [SSSD]
  - Resolves: RHEL-4990 - [RFE] SSSD support for Azure AD / Microsoft Entra ID (or general direct support of OIDC authentication)


author: Scott Mayhew <smayhew@redhat.com> 2.8.3-4
changelog:
  - nfsiostat: normalize the mountpoints passed in from the command line (RHEL-90562)
  - Remove /var/lib/nfs/v4recovery (RHEL-137935)


author: Scott Mayhew <smayhew@redhat.com> 2.8.3-5
changelog:
  - mountd: Minor refactor of get_rootfh() (RHEL-127093)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127093)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127093)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127093)
  - Add requires for selinux-policy (RHEL-127093)
    Resolves: CVE-2025-12801


author: Phil Sutter <psutter@redhat.com> [1.3.0-2.el10]
changelog:
  - utils: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108860]
  - utils: Add helpers for interface name wildcards (Phil Sutter) [RHEL-108860]


author: Phil Sutter <psutter@redhat.com> [1.3.0-3.el10]
changelog:
  - src: Do not include userdata content in debug output (Phil Sutter) [RHEL-119650]
  - Revert "udata: Store u32 udata values in Big Endian" (Phil Sutter) [RHEL-119650]
  - udata: Store u32 udata values in Big Endian (Phil Sutter) [RHEL-119650]
  - data_reg: Support concatenated data (Phil Sutter) [RHEL-119650]
  - data_reg: Respect data byteorder when printing (Phil Sutter) [RHEL-119650]
  - Introduce nftnl_{expr,set_elem}_set_imm() (Phil Sutter) [RHEL-119650]
  - data_reg: Introduce struct nftnl_data_reg::sizes array (Phil Sutter) [RHEL-119650]
  - data_reg: Introduce struct nftnl_data_reg::byteorder field (Phil Sutter) [RHEL-119650]
  - expr: Pass byteorder to struct expr_ops::set callback (Phil Sutter) [RHEL-119650]
  - expr: data_reg: Avoid extra whitespace (Phil Sutter) [RHEL-119650]
  - set_elem: Review debug output (Phil Sutter) [RHEL-119650]


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-9
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131432)
  - CVE-2025-65018: heap buffer overflow (RHEL-131445)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133216)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-10
changelog:
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148832)
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-146650)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.40-8.4
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161324)


author: Pavol Žáčik <pzacik@redhat.com> - 0.12.0-1
changelog:
  - Rebase to 0.12.0
    Resolves: RHEL-133421, RHEL-70825, RHEL-130042
  - Add a Requires for crypto-policies instead of a Recommends
    Resolves: RHEL-139045


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20251111-1
changelog:
  - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config
    (RHEL-123517)
  - Update Intel CPU microcode to microcode-20251111 release (RHEL-128195)
    - Addition of 06-ae-01/0x97 microcode at revision 0x1000273;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c000401 up to 0x2c000410;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000643 up to 0x2b000650;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c000401 up to 0x2c000410;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000643 up to 0x2b000650;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x3a
      up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x437 up to 0x43a;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x437 up to 0x43a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x437 up to 0x43a;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0xa up
      to 0xb;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x437
      up to 0x43a;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa000100 up to 0xa000124;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003d0 up to 0x10003f0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000362
      up to 0x3000382;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12f up
      to 0x132;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12f up to 0x132;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4129 up to 0x6133;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4129 up to 0x6133;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4129
      up to 0x6133;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4129 up to 0x6133;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x123 up
      to 0x125;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1d up
      to 0x1e;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x3a up to 0x3d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x3a up to 0x3d;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x3a up to 0x3d;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x3a up
      to 0x3d;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x3a up to 0x3d;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x119 up
      to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x119 up to 0x11a;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x119 up to 0x11a;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x119 up to 0x11a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002b3 up to 0x210002c0;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002b3
      up to 0x210002c0.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20260210-1
changelog:
  - Update Intel CPU microcode to microcode-20260210 release (RHEL-150997)
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-6a-06/87: Ice Lake-X: d000410 to d000421
    06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1
    06-7e-05/80: Ice Lake-L: 00ca to 00cc
    06-8c-01/80: Tiger Lake: 00bc to 00be
    06-8c-02/c2: Tiger Lake: 003c to 003e
    06-8d-01/c2: Tiger Lake-H: 0056 to 0058
    06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661
    06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421
    06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661
    06-97-02/07: Alder Lake: 003d to 003e
    06-97-05/07: Alder Lake: 003d to 003e
    06-9a-03/80: Alder Lake-L: 043a to 043b
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-a7-01/02: Rocket Lake: 0064 to 0065
    06-aa-04/e6: Meteor Lake-L: 0025 to 0028
    06-ad-01/20: Granite Rapids-X: a000124 to a000133
    06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405
    06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3
    06-b5-00/80: Arrow Lake-U: 000a to 000d
    06-b7-01/32: Raptor Lake: 0132 to 0133
    06-ba-02/e0: Raptor Lake-P: 6133 to 6134
    06-ba-03/e0: Raptor Lake-P: 6133 to 6134
    06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021
    06-bf-02/07: Raptor Lake-S: 003d to 003e
    06-bf-05/07: Raptor Lake-S: 003d to 003e
    06-c5-02/82: Arrow Lake-H: 011a to 011b
    06-c6-02/82: Arrow Lake: 011a to 011b
    06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3
  Resolves: RHEL-150997


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250812-1.20260210-1
changelog:
  - Update Intel CPU microcode to microcode-20260210 release (RHEL-152418)
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-6a-06/87: Ice Lake-X: d000410 to d000421
    06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1
    06-7e-05/80: Ice Lake-L: 00ca to 00cc
    06-8c-01/80: Tiger Lake: 00bc to 00be
    06-8c-02/c2: Tiger Lake: 003c to 003e
    06-8d-01/c2: Tiger Lake-H: 0056 to 0058
    06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661
    06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421
    06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661
    06-97-02/07: Alder Lake: 003d to 003e
    06-97-05/07: Alder Lake: 003d to 003e
    06-9a-03/80: Alder Lake-L: 043a to 043b
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-a7-01/02: Rocket Lake: 0064 to 0065
    06-aa-04/e6: Meteor Lake-L: 0025 to 0028
    06-ad-01/20: Granite Rapids-X: a000124 to a000133
    06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405
    06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3
    06-b5-00/80: Arrow Lake-U: 000a to 000d
    06-b7-01/32: Raptor Lake: 0132 to 0133
    06-ba-02/e0: Raptor Lake-P: 6133 to 6134
    06-ba-03/e0: Raptor Lake-P: 6133 to 6134
    06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021
    06-bf-02/07: Raptor Lake-S: 003d to 003e
    06-bf-05/07: Raptor Lake-S: 003d to 003e
    06-c5-02/82: Arrow Lake-H: 011a to 011b
    06-c6-02/82: Arrow Lake: 011a to 011b
    06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3
  Resolves: RHEL-152418


author: Leo Sandoval <lsandova@redhat.com> - 0.7.2-2
changelog:
  - Rebase several patches from upstream which:
    - Introduce --is-sb-enabled parameter and better return codes
    - Remove unused int_to_b64()
    - Show help on unsupported systems
  - Resolves: #RHEL-90836
  - Resolves: #RHEL-90839


author: Phil Sutter <psutter@redhat.com> [1.1.5-1.el10]
changelog:
  - doc: libnftables-json: Describe RULESET object (Phil Sutter) [RHEL-121194]
  - doc: don't suggest to disable GSO (Phil Sutter) [RHEL-121194]
  - build: don't install ancillary files without systemd service file (Phil Sutter) [RHEL-121194]
  - tests: shell: fix typo in vmap_timeout test script (Phil Sutter) [RHEL-121194]
  - tests: py: inet/osf.t: Fix element ordering in JSON equivalents (Phil Sutter) [RHEL-121194]
  - tests: py: any/ct.t.json.output: Drop leftover entry (Phil Sutter) [RHEL-121194]
  - tests: py: any/tcpopt.t.json: Fix JSON equivalent (Phil Sutter) [RHEL-121194]
  - optimize: Fix verdict expression comparison (Phil Sutter) [RHEL-121194]
  - datatype: Fix boolean type on Big Endian (Phil Sutter) [RHEL-121194]
  - src: parser_json: fix format string bugs (Phil Sutter) [RHEL-121194]
  - doc: fix tcpdump example (Phil Sutter) [RHEL-121194]
  - libnftables: do not re-add default include directory in include search path (Phil Sutter) [RHEL-121194]
  - monitor: Inform JSON printer when reporting an object delete event (Phil Sutter) [RHEL-121194]
  - tests: shell: skip two bitwise tests if multi-register support isn't available (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix regex collecting expected echo output (Phil Sutter) [RHEL-121194]
  - monitor: Quote device names in chain declarations, too (Phil Sutter) [RHEL-121194]
  - tools: gitignore nftables.service file (Phil Sutter) [RHEL-121194]
  - parser_bison: remove leftover utf-8 character in error (Phil Sutter) [RHEL-121194]
  - Rebase onto version 1.1.5 (Phil Sutter) [RHEL-121194]


author: Phil Sutter <psutter@redhat.com> [1.1.5-2.el10]
changelog:
  - spec: Require libnftnl >= 1.3.0-2 for NFTA_DEVICE_PREFIX handling (Phil Sutter) [RHEL-108861]
  - mnl: Drop asterisk from end of NFTA_DEVICE_PREFIX strings (Phil Sutter) [RHEL-108861]
  - tests: shell: Test ifname-based hooks (Phil Sutter) [RHEL-108861]
  - parser_bison: Accept ASTERISK_STRING in flowtable_expr_member (Phil Sutter) [RHEL-108861]
  - mnl: Support simple wildcards in netdev hooks (Phil Sutter) [RHEL-108861]


author: Phil Sutter <psutter@redhat.com> [1.1.5-3.el10]
changelog:
  - Update expected test suite results (Phil Sutter) [RHEL-121194]
  - tests: monitor: Fix for out-of-path call (Phil Sutter) [RHEL-121194]


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75138, ep11 token BLS support
  - Resolves: RHEL-85380, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85383, cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100058, openCryptoki 3.26.0


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-14
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164738
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166237
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166221
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166189
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166205


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-15
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-118406
  - Canonicalize username when matching a user
    Resolves: RHEL-101440


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-17
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128399
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128388


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-21
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155812


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95182
  - Build tests in check and without LTO
    Resolves: RHEL-111634


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-5
changelog:
  - Fix globally disabled LTO
    Related: RHEL-111634
  - Initialize reserved and unused memory in aes-s390x.pl
    Resolves: RHEL-107479


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-122599
    Resolves: RHEL-141987
    Resolves: RHEL-142009
    Resolves: RHEL-142022
    Resolves: RHEL-142026
    Resolves: RHEL-142030
    Resolves: RHEL-142034
    Resolves: RHEL-142038
    Resolves: RHEL-142042
    Resolves: RHEL-142046
    Resolves: RHEL-142050
    Resolves: RHEL-142054


author: Vit Mojzis <vmojzis@redhat.com> - 3.9-2
changelog:
  - semanage: Reset active value when deleting boolean customizations (RHEL-111421)
  - setfiles: Add -A option to disable SELINUX_RESTORECON_ADD_ASSOC (RHEL-111505)


author: Jan Rybar <jrybar@redhat.com> - 4.0.4-11
changelog:
  - ps: etime overflow reappeared with rewritten library
  - uptime, w: report user sessions only; upstream backport of 734930e47
  - Resolves: RHEL-60826
  - Resolves: RHEL-141839


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143057
  Resolves: RHEL-143109
  Resolves: RHEL-144854


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143057, RHEL-143109, RHEL-144854


author: John Kacur <jkacur@redhat.com> - 0.7.4-1
changelog:
  - Rebase to upstream version 0.7.4
  - Convert to pyproject-based build using pyproject.toml
  - Remove python3-six dependency (no longer needed)
  - Remove distutils patch (no longer needed with pyproject build)
  Resolves: RHEL-114904


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-21
changelog:
  - Fix pre/post/meta/etc. qualifiers for weak dependencies (RHEL-101936)
  - Fix redundant rpmdb-migrate.service runs (RHEL-96510)


author: Michal Domonkos <mdomonko@redhat.com> - 4.19.1.1-22
changelog:
  - Ignore signatures made by unknown or disabled algorithms (RHEL-112394)
  - Enable NSS-based user and group lookups again (RHEL-118365)
  - Fix ignored password field if empty in passwd/group file (RHEL-118365)


author: Veronika Doubkova <vdoubkov@redhat.com> - 10.2-10
changelog:
  - Refactor SB certificates to versioned files with symlinks and revert UKI to 504
  - Resolves: RHELBLD-17476


author: mhorky <mhorky@redhat.com> 9-1
changelog:
  - remove src/po.js (tomatus777@tomatus.cz)
  - translate placeholder strings (tomatus777@tomatus.cz)
  - index.html: fix import order and make localization work again (tomatus777@tomatus.cz)
  - Fixes: RHEL-111937


author: Jakub Martisko <jamartis@redhat.com> - 4.9-5
changelog:
  - lib/dfa.c: Increase the maximum size of the transitions table
  - After changes introduced between sed 4.2 and 4.4, some regexps
    started to hit the table size limits. This lead to repeated deletion
    and rebuilding of the table, leading to massive performance drops.
    While the core issue is still present, this change should at least
    help by moving the threshold of the regexp complexity that triggers the 
    table rebuilds.
  - Resolves: RHEL-144027


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.13-1
changelog:
  - Add the rpm_signal() interface
  Related: RHEL-107589
  - Allow tuned_t use its private tmpfs files
  Related: RHEL-107589
  - Allow samba-bgqd send to smbd over a unix datagram socket
  Resolves: RHEL-93731
  - Allow kdump search kdumpctl_tmp_t directories
  Resolves: RHEL-116041
  - Confine redfish_finder - host api discovery service
  Resolves: RHEL-50299
  - Update policy for dhcpc_hook_t
  Resolves: RHEL-113937
  - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  Resolves: RHEL-113937
  - Allow systemd to map files under /sys
  Resolves: RHEL-132638


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.14-1
changelog:
  - Update ktls policy
  Resolves: RHEL-123737
  - Update policy for redfish-finder
  Resolves: RHEL-50299
  - Allow sshd-session read, write, and map ica tmpfs files
  Resolves: RHEL-138247
  - Allow sshd_net_t ioctl on unix_stream_socket of sshd_session_t
  Resolves: RHEL-127721
  - Allow stalld map sysfs files
  Resolves: RHEL-135512
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121479
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129839
  - Allow KDE Plasma Login Manager to function as a display manager
  Resolves: RHEL-135676
  - Update specfile trigger for openwsmand
  Resolves: RHEL-133024


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.15-1
changelog:
  - Allow hostapd write to socket files in /tmp
  Resolves: RHEL-77047
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114104
  - Allow sshd-session inherit limits from its parent process
  Resolves: RHEL-136673
  - Allow sshd noatsecure on sshd-session execution
  Resolves: RHEL-138247
  - Allow sshd-net read and write to sshd vsock socket
  Related: RHEL-138247


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.16-1
changelog:
  - Allow sshd-session inherit limits from its parent sshd process
  Resolves: RHEL-136673
  - Revert "Allow sshd-session inherit limits from its parent process"
  Resolves: RHEL-136673
  - Allow tlshd write generic certificates
  Resolves: RHEL-123737
  - Allow systemd-hostnamed to create its Varlink socket
  Resolves: RHEL-139385
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128555
  - Label /etc/aliases.cdb with etc_aliases_t
  Resolves: RHEL-109976
  - Add aliases.lmdb to mta_filetrans_named_content()
  Resolves: RHEL-140884
  - Update policy for bootupd
  Resolves: RHEL-141391


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.17-1
changelog:
  - Allow rhsmcertd read anaconda run files
  Resolves: RHEL-141391
  - Allow mdadm to use CAP_BPF during RAID monitoring
  Resolves: RHEL-135765
  - Allow mdadm the CAP_SYS_PTRACE capability
  Resolves: RHEL-135765
  - Allow staff and sysadm execute iotop using sudo
  Resolves: RHEL-134940
  - Allow kernel_t to read/write all domains' pipes
  Resolves: RHEL-124442
  - Allow nfsd_t domain setuid and setgid capability for rpc.mountd
  Resolves: RHEL-148107


author: Zdenek Pytela <zpytela@redhat.com> - 42.1.18-1
changelog:
  - Allow NetworkManager list bpf directories
  Resolves: RHEL-142171
  - Dontaudit systemd-generator connect to sssd over a unix stream socket
  Resolves: RHEL-114886
  - Allow pkcsslotd read files in /proc and /sys
  Resolves: RHEL-130812
  - Allow pkcsslotd map its private tmpfs files
  Resolves: RHEL-130812
  - Allow tlshd communication to unconfined_t over a tcp socket
  Resolves: RHEL-125106
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146687
  - Allow NM nvme dispatcher script start systemd services
  Resolves: RHEL-140760
  - Allow tlshd write generic certificate dirs
  Resolves: RHEL-127023
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  Resolves: RHEL-121479
  - Allow plasma login manager stop login services
  Resolves: RHEL-140911
  - Rebuild selinux policy after installation of the extra package
  Resolves: RHEL-135875
  Resolves: RHEL-143926
  - Move triggerin scriptlets to the parent packages
  Resolves: RHEL-141813
  - Rebuild policy before running {binsbin|varrun}-convert.sh
  Resolves: RHEL-141813


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.15.0-11
changelog:
  - passwd.c: lock, open, close and unlock passwd database
    Resolves: RHEL-151055
    Resolves: RHEL-150955


author: Peter Jones <pjones@redhat.com> - 16.1-4
changelog:
  - x86_64: add the "Microsoft UEFI CA 2023 signer" signature and the
    "Red Hat UEFI Publisher 2024" signatures to both shim binaries.
    Resolves: RHEL-144033


author: Alejandro López <allopez@redhat.com> - 1.9.15-10.p5
changelog:
  - Resolves: RHEL-164619 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Alejandro López <allopez@redhat.com> - 1.9.17-2.p2
changelog:
  - Resolves: RHEL-59136 - sudo passes SHELL environment variable twice to
    the shell being executed [rhel-10]
  - Resolves: RHEL-128212 - [RFE] request to backport support for regex in
    sudo [rhel-10]
  - Resolves: RHEL-112100 - Rebase of sudo to 1.9.17p2 [rhel-10]


author: Leo Sandoval <lsandova@redhat.com> - 6.04-0.32
changelog:
  - Bump version and include previous resolves ticket number on commit message
  - Resolves: #RHEL-51170


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.1
changelog:
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.2
changelog:
  - Revert "coredump: fix 0-passed-as-pointer warning" (RHEL-104135)
  - Revert "Define helper to call PR_SET_DUMPABLE" (RHEL-104135)
  - Revert "coredump: introduce an enum to wrap dumpable constants" (RHEL-104135)
  - Revert "coredump: when %F/pidfd is used, again allow forwarding to containers" (RHEL-104135)
  - Revert "coredump: add support for new %F PIDFD specifier" (RHEL-104135)
  - Revert "coredump: get rid of a bogus assertion" (RHEL-104135)
  - Revert "coredump: also stop forwarding non-dumpable processes" (RHEL-104135)
  - Revert "coredump: use %d in kernel core pattern" (RHEL-104135)
  - Revert "coredump: get rid of _META_MANDATORY_MAX" (RHEL-104135)
  - Revert "coredump: wrap long lines, fix grammar in comments" (RHEL-104135)
  - Revert "coredump: restore compatibility with older patterns" (RHEL-104135)
  - Revert "coredump: verify pidfd after parsing data in usermode helper" (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-13.3
changelog:
  - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-155394)
  - ci: add bpftool workaround to codeql job too (RHEL-155394)
  - ci: fix workaround about bpftool for codeql (RHEL-155394)
  - ci: add bpftool workaround to coverity too (RHEL-155394)
  - ci: pin Packit/mkosi to the latest RHEL 10.1 commit (RHEL-155394)
  - ci: run apt-get update before running mkosi (RHEL-155394)
  - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-155394)
  - cgroup: port some code over to path_startswith_full() (RHEL-155394)
  - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-155394)
  - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-155394)
  - core/cgroup: avoid one unnecessary strjoina() (RHEL-155394)
  - core: validate input cgroup path more prudently (RHEL-155394)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-14
changelog:
  - test: add test case for AddDependencyUnitFiles assert (RHEL-108257)
  - TEST-17: drop unnecessary $PATH setting (RHEL-108242)
  - chase: check the result is a directory or regular file only when the resolved path exists (RHEL-108006)
  - bootctl: stop printing "Stub/Boot loader set partition information" (RHEL-108251)
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109552)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-15
changelog:
  - coredump: drop RestrictSUIDSGID= option (#38640) (RHEL-113920)
  - ukify: fix insertion of padding in merged sections (RHEL-114414)
  - core: introduce Unit.dependency_generation counter and restart loop when dependency is updated in the loop (RHEL-112203)
  - core/unit: use UNIT_FOREACH_DEPENDENCY_SAFE() at several more places (RHEL-112203)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-16
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118216)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118216)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118216)
  - timer: don't run service immediately after restart of a timer (RHEL-118216)
  - test: store and compare just the property value (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-17
changelog:
  - pam_systemd: honor session class provided via PAM environment (RHEL-109832)
  - udev/net_id: introduce naming scheme for RHEL-10.2 (RHEL-72813)
  - udev/net_id: introduce naming scheme for RHEL-9.8 (RHEL-72813)
  - test: split VM-only subtests from TEST-74-AUX-UTILS to new VM-only test (RHEL-112205)
  - core/transaction: first drop unmergable jobs for anchor jobs (RHEL-112205)
  - test: add test case for issue #38765 (RHEL-112205)
  - strv: add strv_equal_ignore_order() helper (RHEL-109902)
  - pam: minor coding style tweaks (RHEL-109902)
  - user-record: add helper that checks if a provided user name matches a record (RHEL-109902)
  - user-record: add support for alias user names to user record (RHEL-109902)
  - pam_systemd_home: use right field name in error message (RHEL-109902)
  - pam_systemd_home: support login with alias names + user names with realms (RHEL-109902)
  - homed: support user record aliases (RHEL-109902)
  - homectl: add support for creating users with alias names (RHEL-109902)
  - test: add test for homed alias and realm user resolution (RHEL-109902)
  - update TODO (RHEL-109902)
  - udev: create symlinks for s390 PTP devices (RHEL-120177)
  - test: build the crashing test binary outside of the test (RHEL-113920)
  - test: exclude test-stacktrace(-not)?-symbolized from the coredump check (RHEL-113920)
  - mkosi: install test dependencies for EnterNamespace= test (RHEL-113920)
  - coredump: verify pidfd after parsing data in usermode helper (RHEL-104135)
  - coredump: restore compatibility with older patterns (RHEL-104135)
  - coredump: wrap long lines, fix grammar in comments (RHEL-104135)
  - coredump: get rid of _META_MANDATORY_MAX (RHEL-104135)
  - coredump: use %d in kernel core pattern (RHEL-104135)
  - coredump: also stop forwarding non-dumpable processes (RHEL-104135)
  - coredump: get rid of a bogus assertion (RHEL-104135)
  - coredump: add support for new %F PIDFD specifier (RHEL-104135)
  - coredump: when %F/pidfd is used, again allow forwarding to containers (RHEL-104135)
  - coredump: introduce an enum to wrap dumpable constants (RHEL-104135)
  - Define helper to call PR_SET_DUMPABLE (RHEL-104135)
  - coredump: fix 0-passed-as-pointer warning (RHEL-104135)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-19
changelog:
  - man: fix a missing word (RHEL-120277)
  - sd_bus_open_user_machine(): Don't shortcut without necessary env (RHEL-129179)
  - udev: set clock group for PTP and RTC devices (RHEL-113051)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126122)
  - strv: introduce string_strv_hashmap_remove() (RHEL-126937)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-126937)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-126937)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-126937)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-20
changelog:
  - tools/check-version-history: avoid DeprecationWarning with newer lxml (RHEL-128767)
  - man: don't duplicate version in History section (RHEL-128767)
  - tools: ignore root element explicitly in check-version-history (RHEL-128767)
  - systemd-logind: Add signal section in man systemd-logind (RHEL-128767)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118216)
  - timer: rebase last_trigger timestamp if needed (RHEL-118216)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-22
changelog:
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-125822)
  - hwdb: Add Accelerometer mount matrix for Irbis TW43 (RHEL-72702)
  - hwdb: map FN key on TongFang X4SP4NAL laptops (RHEL-72702)
  - hwdb: update rules (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - Add Razer Cobra mouse to hwdb (RHEL-72702)
  - hwdb: enable autosuspend for Dell DW5826e WWAN modem (RHEL-72702)
  - hwdb: sort SDR devices by vendor name (RHEL-72702)
  - 70-mouse.hwdb: Add Razer Basilisk V3, Asus Cerberus, +2 more (RHEL-72702)
  - hwdb: run "update-hwdb" (RHEL-72702)
  - Add Hantek DSO-6022 oscilloscopes and compatible devices (RHEL-72702)
  - Update 60-sensor.hwdb - Add support for Lenovo Legion Go (RHEL-72702)
  - hwdb: add Airspy devices (RHEL-72702)
  - hwdb: add more devices (RHEL-72702)
  - hwdb: add MiriSDR MSi2500 devices (RHEL-72702)
  - hwdb: add missing Ettus Research B200 rule (RHEL-72702)
  - hwdb: add LimeSDR XTRX devices (RHEL-72702)
  - hwdb: add HydraSDR RFOne (RHEL-72702)
  - hwdb: add SDRplay devices (RHEL-72702)
  - hwdb: update (RHEL-72702)
  - hwdb: fix calibrate rotation sensor for Positivo K116J (#39189) (RHEL-72702)
  - Add Nulea M501 trackball to hwdb (RHEL-72702)
  - add comment to 70-mouse.hwdb regarding generic name for Nulea M501 USB dongle (RHEL-72702)
  - remove extra space from new hwdb.d/70-mouse.hwdb entries to fix failing test (RHEL-72702)
  - remove bonus line (RHEL-72702)
  - hwdb: drop trailing whitespace (RHEL-72702)
  - remove Nulea M501 usb entry from hwdb (RHEL-72702)
  - test/parse_hwdb: wrap Or inside an And in a Group (RHEL-72702)
  - rules: extend 60-input-id.rules to allow for bus/vid/pid/name matches (RHEL-72702)
  - hwdb: don't tag a named Mouse device as pointingstick (RHEL-72702)
  - hwdb: Add V64x_V65xAU to list of Clevo models where scancode f7+f8 get mapped to touchpad-toggle (RHEL-72702)
  - hwdb: gpd micropc2 sensor (#39493) (RHEL-72702)
  - hwdb: add support for the Logitech MX Master 4 (#39490) (RHEL-72702)
  - hwdb: add entry for Acer Switch One 10 (SW1-011) (#39716) (RHEL-72702)
  - keymap: Ignore brightness keys on Dell Inspiron 3505 to avoid double events (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: Add Elecom IST Pro trackball (#39762) (RHEL-72702)
  - hwdb: Fix keyboard backlight keys on Acer Nitro 5 AN515-58 (#39769) (RHEL-72702)
  - hwdb: Add alternative mode for Beacn Mic (#39868) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: add ProtoArc EM01 NL mouse configuration (RHEL-72702)
  - hwdb: add Magic Trackpad v2 USB-C (2024) to quirks (#40032) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad D330 accel mount matrix (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: update autosuspend rules (RHEL-72702)
  - hwdb: Add ACCEL_MOUNT_MATRIX for variant of TERRA PAD 1061 (RHEL-72702)
  - hwdb: sensor: Add HP OmniBook Ultra Flip 14 accel mount matrix (#40076) (RHEL-72702)
  - hwdb: sensor: Remove Lenovo IdeaPad Duet 3 accel mount matrix (#40075) (RHEL-72702)
  - hwdb: Fix ACCEL_MOUNT_MATRIX for Lenovo Ideapad MIIX 310-ICR (#40067) (RHEL-72702)
  - hwdb: fix unstable button triggering on Mipad 2 under GNOME (#40071) (RHEL-72702)
  - Update hwdb (RHEL-72702)
  - hwdb: touchpad config for Apple MacbookPro12,1 Early 2015 (RHEL-72702)
  - Add Lenovo Y50-70 touchpad to 60-evdev.hwdb (RHEL-72702)
  - quirks: sensor: add info about ACPI accel_matrix (RHEL-72702)
  - quirks: Re-add D330 accel_matrix as identity one (#40226) (RHEL-72702)
  - quirks: touchpad: Set Duet 3 bt touchpad internal (RHEL-72702)
  - hwdb: Add missing scancodes for Lenovo Legion devices (RHEL-72702)
  - hwdb: Add missing vendor names for older AYANEO devices Adds AYADEVICE and AYA NEO vendor names. Early founders editon and 2021 models used these DMI values instead of AYANEO (RHEL-72702)
  - hwdb: add matrix for ASUS 2-in-1 T101HA (RHEL-72702)
  - hwdb: add HP EliteBoard Mic mute key mapping (RHEL-72702)
  - hwdb: Add GPD Pocket 4 chassis quirk (RHEL-72702)
  - hwdb: make three more hwdb files parsed by parse_hwdb.py (RHEL-72702)
  - hwdb: set touchpad resolution for all ThinkPad T49x chassis laptops (RHEL-72702)
  - hwdb: Update Lenovo Legion Go Models - Different BIOS versions of the Legion Go 2 can init the keyboard   device as set 1 (appears as raw set 2) or as set 2 (appears as   translated set 2). Add the Legion Go 2 to the Translated list. - While at it, specify the models in a more verbose manner for   posterity. (RHEL-72702)
  - hwdb: Add extended SteelSeries Arctis headset device support (#40479) (RHEL-72702)
  - hwdb: keyboard: fix typo CAPSLOCK to NUMLOCK (RHEL-72702)
  - hwdb: keyboard: uppercase apple id (RHEL-72702)
  - integritysetup: Add support for hmac-sha512 (RHEL-27852)
  - integritysetup: Add PHMAC algorithm to list of known algorithms (RHEL-27852)
  - core: increment start limit counter only when we can start the unit (RHEL-115032)
  - TEST-07-PID1: wait for systemd-resolved being stopped (RHEL-115032)
  - test: extend start limit interval (RHEL-115032)
  - userdbctl: optionally show user/group data from JSON filerather than from system (RHEL-143029)
  - man: fix typo (RHEL-143029)
  - test: fix test with -Dnetworkd=false (RHEL-143029)
  - ci: run apt-get update before running mkosi (RHEL-115001)


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23
changelog:
  - test-journal-dump: dump the headers of journal files (RHEL-106795)
  - journal: store counts, not byte sizes, in table size constants (RHEL-106795)
  - journal: treble field hash table size (RHEL-106795)
  - nspawn: move uid shift/chown() code into shared/ (RHEL-143036)
  - user-classification: add new "foreign" UID range (RHEL-143036)
  - userdb: synthesize stub user records for the foreign UID (RHEL-143036)
  - dissect: add new --shift command (RHEL-143036)
  - userdb: optionally parse numeric UIDs/GIDs where a username is expected (RHEL-143036)
  - userdbd: separate parameter structure of GetMemberships() varlink call from the GetUserRecord() one (RHEL-143036)
  - userdb: move setting of 'service' varlink parameter into userdb_connect() (RHEL-143036)
  - user-record: make a NULL UserDBMatch be equivalent to no filtering (RHEL-143036)
  - sd-varlink: add sd_varlink_get_description() call (RHEL-143036)
  - user-record: add helper for dispatching a disposition mask (RHEL-143036)
  - user-record: rename USER_DISPOSITION_MASK_MAX → USER_DISPOSITION_MASK_ALL (RHEL-143036)
  - user-record: add some helpers for working with UserDBMatch (RHEL-143036)
  - varlink: add new calls for server-side user record filtering to varlink IDL + to spec (RHEL-143036)
  - userdb: move UserDBMatch handling from userdbctl into generic userdb code to allow it to be done server side (RHEL-143036)
  - userdbd: implement server side filtering in the Multiplexer API (RHEL-143036)
  - homectl: port has_regular_user() + acquire_group_list() to use server-side filtering (RHEL-143036)
  - update TODO (RHEL-143036)
  - JSON User/Group records: Add properties for UUIDs (RHEL-143036)
  - userdb: add support for printing the UUID from user and group records (RHEL-143036)
  - userdb: add support for looking up users or groups by uuid. (RHEL-143036)
  - userdbctl: add --uuid filtering option (RHEL-143036)
  - userdbctl: add missing --uuid= to --help text (RHEL-143036)
  - userdb: fix typo (RHEL-143036)
  - man/userdbctl: fixup version info (RHEL-143036)
  - user-record: add a concept of inverting per-host matching sections in user record (RHEL-143034)
  - homectl: add interface for controlling storage for negative machine ID matches (RHEL-143034)
  - logind: also save pidfdid as part of session state, even if we don't parse it (RHEL-53112)
  - logind: support deserializing session leader through pidfdid (RHEL-53112)
  - TEST-35-LOGIN: test coldplug without fdstore on kernels with pidfd id (RHEL-53112)
  - logind: fix potential fd leak in deliver_session_leader_fd_consume() (RHEL-53112)
  - Revert "coredump: lock down EnterNamespace= mount even more" (RHEL-95219)
  - coredump: add compat support for SYSTEMD_COREDUMP_ALLOW_NAMESPACE_CHANGE (RHEL-95219)


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-10
changelog:
  - added "padding with zeros" info message (#2089298)
  - do not report disk error as file shrank (#2089316)
  - upstream fix for savannah bug 64581, commit 51142180
    (crash with TAR_OPTIONS)
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.35-11
changelog:
  - Add upstream patch to improve error message for --one-top-level
    with absolute path (unsupported as a result of CVE-2025-45582 fix)


author: John Kacur <jkacur@redhat.com> - 0.20-1
changelog:
  - Update to upstream version 0.20
  - Convert spec file to use pyproject-rpm-macros
  - Use %pyproject_buildrequires, %pyproject_build, %pyproject_install
  - Use %pyproject_save_files for automatic file list generation
  - Remove oscilloscope (unsupported in RHEL)
  Resolves: RHEL-114902, RHEL-83080


author: John Kacur <jkacur@redhat.com> - 0.20-2
changelog:
  - Add python3-pip, python3-setuptools, python3-wheel BuildRequires
  - Delete setup.py in %prep so pyproject.toml build is used
  - Compress man page during %prep similar to rteval
  - Install tuna script and compressed man page explicitly
  Resolves: RHEL-114902


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123608
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
      resolves: RHEL-40619
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
      resolves: RHEL-142285
    - man: fixed instance_acquire_devices example in tuned-adm man
      resolves: RHEL-90575
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: - Chung Chung <cchung@redhat.com> - 8.3.2.1-1
changelog:
  - Add vdocalculatesize utility.
  - Improve handling of corrupt index metadata.
  - Resolves: RHEL-129392


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.2
changelog:
  - RHEL-155425 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.2
changelog:
  - RHEL-155409 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Petr Dancak <pdancak@redhat.com> - 2:9.1.083-6.3
changelog:
  - RHEL-159615 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155426 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9
changelog:
  - RHEL-155410 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:9.1.083-9.1
changelog:
  - RHEL-159616 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Florian Weimer <fweimer@redhat.com> - 2.39-120
changelog:
  - Sync with upstream branch release/2.39/master (RHEL-151554)
  - Upstream commit: 0dc95ae10929aba1cc660e97cfc94903c2568efa
  - resolv: Check hostname for validity (CVE-2026-4438)
  - resolv: Count records correctly (CVE-2026-4437)
  - iconvdata: Fix invalid pointer arithmetic in ANSI_X3.110 module


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.7.2.el10_2]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172542]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172542]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172542]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172542]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172542] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172542] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172542]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172542] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172542] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172542]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.7.3.el10_2]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174546] {CVE-2026-43284}


author: Julien Rische <jrische@redhat.com> - 1.21.3-9
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-145356
  - Create sub-package for xrealmauthz KDC plugin
    Resolves: RHEL-145358
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-145397


author: Tomas Halman <thalman@redhat.com> - 2.12.0-3
changelog:
  - Resolves: RHEL-167749 - SSSD IdP (Entra ID): listing group members does not work
  - Resolves: RHEL-167757 - sssd-kcm fails to start if krb5_renew_interval is specified


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-23
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164739
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166238
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166222
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166190
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166206


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  - Require expat >= 2.7.2 to prevent symbol lookup errors at runtime with older expat
  Related: RHEL-167886, RHEL-168120


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-167886, RHEL-168120


author: Alejandro López <allopez@redhat.com> - 1.9.17-3.p2
changelog:
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: Alejandro López <allopez@redhat.com> - 1.9.17-4.p2
changelog:
  - Bump release number
  - Resolves: RHEL-164620 - CVE-2026-35535 sudo: Sudo: Privilege escalation
    due to failure in privilege drop calls


author: systemd maintenance team <systemd-maint@redhat.com> - 257-23.1
changelog:
  - ci: re-enable bpf-framework option for build and unit test jobs (RHEL-152080)
  - ci: add bpftool workaround to codeql job too (RHEL-152080)
  - ci: fix workaround about bpftool for codeql (RHEL-152080)
  - ci: add bpftool workaround to coverity too (RHEL-152080)
  - path-util: add flavour of path_startswith() that leaves a leading slash in place (RHEL-152080)
  - cgroup: port some code over to path_startswith_full() (RHEL-152080)
  - path-util: invert PATH_STARTSWITH_ACCEPT_DOT_DOT flag (RHEL-152080)
  - sd-json: fix off-by-one issue when updating parent for array elements (RHEL-152080)
  - core/cgroup: avoid one unnecessary strjoina() (RHEL-152080)
  - core: validate input cgroup path more prudently (RHEL-152080)


author: Julien Rische <jrische@redhat.com> - 1.21.3-10
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171588 RHEL-171597


author: Michal Ruprich <mruprich@redhat.com> - 3.4.1-5
changelog:
  - Resolves: RHEL-169137 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.8.1.el10_2]
changelog:
  - ice: drop udp_tunnel_get_rx_info() call from ndo_open() (Mohammad Heib) [RHEL-165081]
  - i40e: drop udp_tunnel_get_rx_info() call from i40e_open() (Mohammad Heib) [RHEL-165081]
  - ALSA: hda/tas2781: Ignore reset check for SPI device (Jaroslav Kysela) [RHEL-157285]
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158990]
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159227] {CVE-2025-68741}
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Vinay Mulugund) [RHEL-155205]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158206]
  - net: openvswitch: Avoid releasing netdev before teardown completes (Toke Høiland-Jørgensen) [RHEL-157946]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155971]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155971]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150456] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150456] {CVE-2025-39766}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.10.1.el10_2]
changelog:
  - ASoC: soc_sdw_utils: remove index from sdca codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: soc_sdw_utils: partial match the codec name (Jaroslav Kysela) [RHEL-163717]
  - ASoC: add snd_soc_lookup_component_by_name helper (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Update counting of SU/GE DAPM routes (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Handle CONFIG_PM_SLEEP not being set (Jaroslav Kysela) [RHEL-163717]
  - ASoC: SDCA: Tidy up some memory allocations (Jaroslav Kysela) [RHEL-163717]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157332] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.11.1.el10_2]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-168569] {CVE-2026-31402}
  - KVM: x86/mmu: Only WARN in direct MMUs when overwriting shadow-present SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153716] {CVE-2026-23401}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.12.1.el10_2]
changelog:
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-169354]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-169354]
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166932] {CVE-2025-68724}
  - net: af_can: do not leave a dangling sk pointer in can_create() (CKI Backport Bot) [RHEL-162253] {CVE-2024-56603}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.13.1.el10_2]
changelog:
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171531]
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (CKI Backport Bot) [RHEL-170974] {CVE-2026-31408}


author: Patrick Talbert <ptalbert@redhat.com> [6.12.0-211.14.1.el10_2]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172213]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172213]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172213] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172213]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172213] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172213] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172213]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.16.1.el10_2]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176053] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176449] {CVE-2026-46333}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174029] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171434] {CVE-2026-31607}


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170780)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-4
changelog:
  - Fix 3.8.13 CVEs and security issues, update Makefile.in
  - Fix CVE-2026-33846
  - Fix CVE-2026-42009
  - Fix CVE-2026-33845
  - Fix CVE-2026-42010
  - Fix CVE-2026-3833
  - Fix CVE-2026-42011
  - Fix CVE-2026-42012
  - Fix CVE-2026-42013
  - Fix CVE-2026-42014
  - Fix CVE-2026-5260
  - Fix CVE-2026-42015
  - Fix CVE-2026-3832
  - Fix CVE-2026-5419
  - Fix upstream security issue #1808
  - Fix upstream security issue #1810
  - Fix upstream security issue #1813
  - Fix upstream security issue #1818
  - Fix upstream security issue #1818
  - Fix upstream security issue #1819
  - Fix upstream security issue #1822
  - Fix upstream security issue #1841
  - Fix upstream security issue #1823
  - Fix upstream security issue #1817
  - Fix upstream security issue #1820
  - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in


author: Tomas Matus <tmatus@redhat.com> - 356.1-1
changelog:
  - ws: Prevent remote code execution with SSH argument injection (RHEL-158306)
  - node: update lodash dependency (RHEL-164067)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.17.1.el10_2]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169625]
  - redhat/kernel.spec.template: disable OBJTOOL_WERROR for gcov builds (Oleksii Baranov)
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174756] {CVE-2026-43303}
  - dpaa2-switch: validate num_ifs to prevent out-of-bounds write (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - dpaa2-switch: prevent ZERO_SIZE_PTR dereference when num_ifs is zero (CKI Backport Bot) [RHEL-174258] {CVE-2026-43205}
  - mm: thp: deny THP for files on anonymous inodes (Rafael Aquini) [RHEL-171617] {CVE-2026-23375}
  - fs: add S_ANON_INODE (Rafael Aquini) [RHEL-171617]
  - anon_inode: raise SB_I_NODEV and SB_I_NOEXEC (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_setattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: explicitly block ->setattr() (Rafael Aquini) [RHEL-171617]
  - pidfs: use anon_inode_getattr() (Rafael Aquini) [RHEL-171617]
  - anon_inode: use a proper mode internally (Rafael Aquini) [RHEL-171617]
  - ice: set max queues in alloc_etherdev_mqs() (CKI Backport Bot) [RHEL-174331]
  - ice: use netif_get_num_default_rss_queues() (CKI Backport Bot) [RHEL-174331]
  - net: Fix rcu_tasks stall in threaded busypoll (CKI Backport Bot) [RHEL-170809]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174217] {CVE-2026-43190}
  - netfilter: ctnetlink: ensure safe access to master conntrack (CKI Backport Bot) [RHEL-173872] {CVE-2026-43116}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173857] {CVE-2026-43110}
  - redhat/configs: enable CONFIG_AQTION on all archs (CKI Backport Bot) [RHEL-171944]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172745] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172625] {CVE-2026-43027}
  - io_uring/rsrc: reject zero-length fixed buffer import (CKI Backport Bot) [RHEL-172556] {CVE-2026-43006}
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164434]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164434]
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-171637]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-171637]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171159] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171142] {CVE-2026-31684}
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150180]
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-169786]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-169786]
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166991] {CVE-2026-23455}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169738] {CVE-2025-68183}
  - can: j1939: j1939_session_new(): fix skb reference counting (CKI Backport Bot) [RHEL-162260] {CVE-2024-56645}
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160469] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [6.12.0-211.18.1.el10_2]
changelog:
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174051] {CVE-2026-43158}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172603] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172577] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-133872]


