# changelog

author: Jiri Hnidek <jhnidek@redhat.com> 1.29.47-1
changelog:
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Spanish) (fserrador@gmail.com)
  - Translated using Weblate (Spanish) (jsefler@redhat.com)
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - fix: [1.29] Wait random time before reaching IMDS server (jhnidek@redhat.com)
  - feat: [1.29] Call random.seed() at begining of auto-register
    (jhnidek@redhat.com)
  - feat: [1.29] Better control over auto-reg waiting game (jhnidek@redhat.com)
  - fix: [1.29] Enable content during auto-registration v2 (jhnidek@redhat.com)


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-1
changelog:
  - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7
  - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9]
  - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID
  - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9]
  - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-3
changelog:
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
  - Resolves: RHEL-103434 - cache_credentials = true not working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-4
changelog:
  - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Steve Dickson <steved@redhat.com> 2.5.4-35
changelog:
  - nfs(5): Add new rdirplus functionality, clarify (RHEL-87143)
  - nfsd: allow more than 64 backlogged connections (RHEL-87752)


author: Steve Dickson <steved@redhat.com> 2.5.4-37
changelog:
  - gssd.man: add documentation for use-gss-proxy nfs.conf option (RHEL-85408)
  - gssd: do not use krb5_cc_initialize (RHEL-85412)


author: Patsy Griffin <patsy@redhat.com> - 6.04-4
changelog:
  - Activate previously added patch to improve mktime documentation and
    add 3 related upstream patches including an example.
    Related: RHEL-58342


author: Patsy Griffin <patsy@redhat.com> - 6.04-7
changelog:
  - Break up man-pages-additional-20140218.tar.xz
  - Add rtas.2, swapcontext.2 and cons.saver.8 man pages as a patch.
    Resolves: RHEL-101596


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250211-1.20250812.1
changelog:
  - Update Intel CPU microcode to microcode-20250812 release
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd000404
      up to 0xd000410;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002d0
      up to 0x10002e0;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-08) from revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-08) from
      revision 0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-08) from revision 0x2b000639 up to 0x2b000643;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode from revision
      0x2c0003f7 up to 0x2c000401;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode from revision
      0x2b000639 up to 0x2b000643;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x24
      up to 0x25;
    - Update of 06-ad-01/0x20 (GNR-AP/SP H0) microcode from revision
      0xa0000d1 up to 0xa000100;
    - Update of 06-ad-01/0x95 (GNR-AP/SP B0) microcode from revision
      0x10003a2 up to 0x10003d0;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000341
      up to 0x3000362;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4128 up to 0x4129;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4128 up to 0x4129;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4128
      up to 0x4129;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4128 up to 0x4129;
    - Update of 06-bd-01/0x80 (LNL B0) microcode from revision 0x11f up
      to 0x123;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode from revision 0x118 up
      to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) from revision 0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) from
      revision 0x118 up to 0x119;
    - Update of 06-c5-02/0x82 (ARL-H A1) microcode (in intel-ucode/06-c6-02)
      from revision 0x118 up to 0x119;
    - Update of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode from revision
      0x118 up to 0x119;
    - Update of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) from
      revision 0x118 up to 0x119;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x210002a9 up to 0x210002b3;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x210002a9
      up to 0x210002b3.


author: Phil Sutter <psutter@redhat.com> [1.0.9-4.el9]
changelog:
  - parser_json: fix handle memleak from error path (Phil Sutter) [RHEL-88181]
  - json: deal appropriately with multidevice in chain (Phil Sutter) [RHEL-88181]


author: Than Ngo <than@redhat.com> - 3.25.0-1
changelog:
  - Resolves: RHEL-73344, upgrade openCryptoki
  - Resolves: RHEL-90590, basic support of AES-GCM
  - Resolves: RHEL-72965, cca token support cipher keys
  - Resolves: RHEL-72969, support for CKM_RSA_AES_KEY_WRAP for cca, ica and soft tokens
  - Resolves: RHEL-75141, add a tool to import/export PKCS #11 keys from to a KMIP server
  - Resolves: RHEL-75762, ep11 token: import and export of secure key objects
  - Resolves: RHEL-85375, cca token: Support ECDH to derive AES keys
  - Resolves: RHEL-85377, ep11 token: PKCS #11 3.0 - support SHA3


author: Than Ngo <than@redhat.com> - 3.25.0-2
changelog:
  - Related: RHEL-73344, Fix detection of EC curve not supported by OpenSSL-3.5.x
  - Related: RHEL-77147, Fix the image mode issue again as bootc expects to use /run/lock


author: Than Ngo <than@redhat.com> - 3.25.0-3
changelog:
  - Fix incorrect effective group id of pkcsslotd daemon
  - Fix covscan findings
    Resolves: RHEL-104602


author: Than Ngo <than@redhat.com> - 3.25.0-4
changelog:
  - Fix pkcsslotd fails to start in FIPS
  - Drop tier1 test as it mostly provides duplicate results
  - Enable ci test for FIPS mode
    Resolves: RHEL-109050


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-7
changelog:
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76756


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-1
changelog:
  - Rebasing OpenSSL to 3.5
    Resolves: RHEL-80854
    Resolves: RHEL-50208
    Resolves: RHEL-50210
    Resolves: RHEL-50211
    Resolves: RHEL-85954


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-2
changelog:
  - OpenSSL ignores "rh-allow-sha1-signatures = yes" option on RHEL-9
    Resolves: RHEL-88910
  - PKCS#12 should not default to pbmac1 in FIPS mode in RHEL-9
    Resolves: RHEL-88912
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-89860
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-89861
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-89862
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-89859
  - Enable sslkeylog support
    Resolves: RHEL-90854


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80854
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-95239


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80854


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-104236
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-104856


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-26
changelog:
  - pam_unix: sync expiry checks with shadow.
    Resolves: RHEL-70519, RHEL-95475, RHEL-96955 and RHEL-96973
  - pam.conf: remove tallylog. Resolves: RHEL-15324
  - pam_namespace: fix potential privilege escalation.
    Resolves: CVE-2025-6020 and RHEL-96727


author: Marek Blaha <mblaha@redhat.com> - 4.3.0-21
changelog:
  - reposync: Avoid multiple downloads of duplicate packages (RHEL-64320)
  - Fix bogus changelog entry date


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.23-1
changelog:
  - Update to 3.9.23
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-38
changelog:
  - Add support for spec local file attributes and generators (RHEL-52772)
  - Store configurable digest(s) on packages in rpmdb (RHEL-35619)
  - Fix a hard link race condition in brp-strip (RHEL-74011)


author: Veronika Doubkova <vdoubkov@redhat.com> - 9.7-0.4
changelog:
  - Provide system-release(releasever_major) and system-release(releasever_minor)
  - Resolves: RHELBLD-17042


author: systemd maintenance team <systemd-maint@redhat.com> - 252-51.2
changelog:
  - Add a set of assertion macros to tests.h (ASSERT_OK(), ASSERT_EQ(), ASSERT_GE(), ASSERT_LE()) that log the failed condition before crashing and convert test-gpt.c test file to use them (RHEL-108481)
  - Follow up with the PR #31819 (RHEL-108481)
  - Added more ASSERT macro and also make some test file to use them (RHEL-108481)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-108481)
  - test: add test case for issue #38265 (RHEL-108481)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-51.3
changelog:
  - meson: /etc/systemd/network is also used by udevd (RHEL-111610)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-111629)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111629)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111629)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-111629)
  - core: do not disconnect from bus when failed to install signal match (RHEL-111629)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111629)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111629)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111629)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111629)
  - core/manager: drop duplicate bus track deserialization (RHEL-111629)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111629)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-52
changelog:
  - man: be even clearer that tmpfiles user/group/mode are applied on existing inodes (RHEL-15051)
  - unit: always return 1 in log_kill (RHEL-78170)
  - ci: enable mkosi workflow for z-stream branches (RHEL-79977)
  - ci(mkosi): bump fedora version from 39 to 41 (RHEL-79977)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-53
changelog:
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-86891)
  - backlight: Drop support for actual_brightness (RHEL-86714)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-54
changelog:
  - unit: add conditions and deps to make oomd.socket and .service consistent (RHEL-90417)
  - udev/net_id: introduce naming scheme for RHEL-9.7 (RHEL-25516)
  - Add a set of assertion macros to tests.h (ASSERT_OK(), ASSERT_EQ(), ASSERT_GE(), ASSERT_LE()) that log the failed condition before crashing and convert test-gpt.c test file to use them (RHEL-103753)
  - Follow up with the PR #31819 (RHEL-103753)
  - Added more ASSERT macro and also make some test file to use them (RHEL-103753)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-103753)
  - test: add test case for issue #38265 (RHEL-103753)
  - test: answer 2nd mdadm --create question for compat with new version (RHEL-79977)
  - sysusers: cross-check user and group names too (RHEL-72572)
  - test-sysusers: check group creation with matching user entry (RHEL-72572)
  - user-sessions: do not remove /etc/nologin (RHEL-85467)
  - hwdb: f20 → micmute (RHEL-72697)
  - hwdb: f21 → touchpad_toggle (RHEL-72697)
  - hwdb: f22 → touchpad_on (RHEL-72697)
  - hwdb: f23 → touchpad_off (RHEL-72697)
  - hwdb: drop some now redundant mappings (RHEL-72697)
  - hwdb: Add micmute for System76 (RHEL-72697)
  - hwdb: Add newer System76 Pangolins (RHEL-72697)
  - hwdb: WALTOP International Corp. Slim Tablet Stylus (RHEL-72697)
  - hwdb: add MSI Claw 8 AT Keyboard Scancodes (#36180) (RHEL-72697)
  - Adds asus T103HAF rotation matrix to 60-sensor.hwdb (#36177) (RHEL-72697)
  - hwdb: fix screen rotation for EXO Wings 2in1 w1125 (#36283) (RHEL-72697)
  - hwdb: XBox Series Elite controller modalias entry has been added. (#36305) (RHEL-72697)
  - hwdb: add front button support for MSI Claw 7 AI+ A2VM (RHEL-72697)
  - hwdb: add accel orientation and location for the BMAX Y14 (RHEL-72697)
  - hwdb.d: add support for Akoya P15645 (RHEL-72697)
  - hwdb.d: add ANP09 Intel n100 tablet sensor configuration (#36390) (RHEL-72697)
  - hwdb: add axis range corrections for the Lenovo Yoga Slim 7 14ARE05 (RHEL-72697)
  - hwdb: add GOLD WARRIOR SIM PhoenixRC 10411R (RHEL-72697)
  - hwdb: add Code Mercenaries Hard- und Software GmbH Virtual RC USB (RHEL-72697)
  - hwdb: Add accel orientation quirk for the GPD Pocket 4 (RHEL-72697)
  - hwdb: add rotation profile matrix for Rog Ally X (2024) (#36591) (RHEL-72697)
  - hwdb: fix backspace not working on HP Pavilion laptop (#36777) (RHEL-72697)
  - hwdb/keyboard: Map FN key on TUXEDO NB02 devices (RHEL-72697)
  - hwdb: add G-Mode key support (#37175) (RHEL-72697)
  - hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1 (RHEL-72697)
  - hwdb: add HP 150 Wired Mouse (#37341) (RHEL-72697)
  - Add emulated release to G-Mode key (RHEL-72697)
  - hwdb: keyboard: Add Alienware special keys (RHEL-72697)
  - hwdb: add bladeRF SDR devices (RHEL-72697)
  - hwdb: append ID_SOFTWARE_RADIO to hwdb parser (RHEL-72697)
  - hwdb.d: reword and simplify boilerplate texts (RHEL-72697)
  - hwdb.d: update/expand boilerplate on various hwdb files (RHEL-72697)
  - hwdb: say that settings can be also set to 0 (RHEL-72697)
  - hwdb: add Analog Devices PLUTO SDR (RHEL-72697)
  -  hwdb: append ID_MM_DEVICE_IGNORE to hwdb parser (RHEL-72697)
  - hwdb: run "update-hwdb" (RHEL-72697)
  - hwdb: run "update-hwdb-autosuspend" (RHEL-72697)
  - hwdb: add missing PLUTO SDR vendor name (RHEL-72697)
  - hwdb: add Ettus Research SDR devices (RHEL-72697)
  - hwdb: add RTL-SDR devices (RHEL-72697)
  - hwdb: merge entries for Ettus Research B200 (RHEL-72697)
  - hwdb: make Saitek PLC Pro Flight Rudder Pedals a joystick (#37601) (RHEL-72697)
  - hwdb: fix touchpad for ASUS X1504ZA (#37696) (RHEL-72697)
  - hwdb: add support for Loupedeck devices (RHEL-72697)
  - hwdb: Acer Nitro ANV15-51 Mic Toggle (RHEL-72697)
  - hwdb: Added Beacn and TC-Helicon Audio controllers (#37798) (RHEL-72697)
  - hwdb: Add support for Lenovo IdeaPad Slim 5 series (RHEL-72697)
  - hwdb: Add hwbd definitions for maker tools (RHEL-72697)
  - hwdb: Add accel orientation quirk for the Microtech e-tab Pro (RHEL-72697)
  - hwdb: add 70-maker-tools.hwdb to meson.build (RHEL-72697)
  - hwdb: fix typo in 70-maker-tools.hwdb (RHEL-72697)
  - hwdb: update (RHEL-72697)
  - Fix Positivo K116J search key and www shortcut (RHEL-72697)
  - hwdb: Acer Nitro ANV15-51 Nitro Sense Toggle (RHEL-72697)
  - hwdb: several cleanups (RHEL-72697)
  - hwdb: disable Asus ROG keyboards sending poweroff (RHEL-72697)
  - hwdb: update (RHEL-72697)
  - hwdb: update autosuspend rules (RHEL-72697)
  - hwdb: set touchpad resolution for ThinkPad T14 Gen2a (RHEL-72697)
  - Revert "hwdb: disable Asus ROG keyboards sending poweroff" (RHEL-72697)
  - hwdb: Add launch emoji keyboard mapping for Asus M1607KA (RHEL-72697)
  - Enable KEY_PERFORMANCE key present on Linux 6.17 (RHEL-72697)
  - flush_ports: flush POSIX message queues properly (RHEL-90860)
  - kernel-install: add --entry-type=type1|type2 option to kernel-install (RHEL-83932)
  - kernel-install: add --entry-type=type1|type2 option to kernel-install.in (RHEL-83932)
  - kernel-install: do not mix || and && (RHEL-83932)
  - man/kernel-install: mention --entry-type= option in the man page (RHEL-83932)
  - cgroup: add support for memory.peak (RHEL-95797)
  - core: include peak memory in unit_log_resources() (RHEL-95797)
  - run: include peak memory in output (RHEL-95797)
  - core: ensure init.scope is realized after drop-ins have been loaded (RHEL-103488)
  - core: add possibility to not track certain unit types (RHEL-89796)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55
changelog:
  - tree-wide: check more log message format in log_struct() and friends (RHEL-100353)
  - build: add some coloring to --version output (RHEL-100353)
  - core: output log cycle path in one log message, not many (RHEL-100353)
  - core: make log cycle messages recognizable via message IDs (RHEL-100353)
  - core: change ordering cycle log message log levels (RHEL-100353)
  - core: cast log_oom() got void (RHEL-100353)
  - core: when removing a job from a transaction, include in structured log message which (RHEL-100353)
  - catalog: add entries for the order cycle log messages (RHEL-100353)
  - tree-wide: check more log message format in log_struct() and friends (RHEL-100353)
  - core/transaction: do not attempt to log "n/a" as a journal field (RHEL-100353)


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.56-1
changelog:
  - Remove 3 permissive domains
  Resolves: RHEL-82674
  - Allow tuned-ppd dbus chat with xdm
  Resolves: RHEL-87203
  - Allow system-dbusd list systemd-machined directories
  Resolves: RHEL-85379
  - Allow NetworkManager create and use icmp_socket
  Resolves: RHEL-83529
  - Allow journalctl connect to systemd-userdbd over a unix socket
  Resolves: RHEL-82673
  - allow gdm and iiosensorproxy talk to each other via D-bus
  Resolves: RHEL-80697
  - Allow varnishd execute the prlimit64() syscall
  Resolves: RHEL-77995
  - Allow system_dbusd_t r/w unix stream sockets of unconfined_service_t
  Resolves: RHEL-61928
  - Add the getattr permission to 2 dontaudit interfaces
  Resolves: RHEL-59145


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.57-1
changelog:
  - Update policy for haproxyd
  Resolves: RHEL-88045
  - Allow NetworkManager manage NetworkManager_etc_rw_t symlinks
  Resolves: RHEL-86178
  - Allow lldpad connect to systemd-userdbd over a unix socket
  Resolves: RHEL-84046
  - Allow gconfd connect to system dbus
  Resolves: RHEL-77984
  - Allow login_pgm read filesystem sysctls
  Resolves: RHEL-77745
  - Allow login_userdomain create /run/tlog directory with user_tmp_t
  Resolves: RHEL-47241


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.58-1
changelog:
  - Allow mptcpd the net_admin capability
  Resolves: RHEL-81729
  - Allow networkmanager send a general signal to iptables
  Resolves: RHEL-93741
  - Make bootupd use bootupd_tmp_t as its private type for files in /tmp
  Resolves: RHEL-94508
  - Update bootupd policy
  Resolves: RHEL-94508
  - Allow switcheroo-control dbus chat with xdm
  Resolves: RHEL-93335
  - Update the files_search_mnt() interface
  Resolves: RHEL-94184


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.59-1
changelog:
  - virt: allow QEMU use of the qgs daemon for attestation
  Resolves: RHEL-87744
  - qgs: add contrib module for TDX "qgs" daemon
  Resolves: RHEL-87744
  - kernel: add interfaces for using SGX enclaves
  Resolves: RHEL-87744
  - Allow coreos-installer search sssd library directory
  Resolves: RHEL-95689
  - Label /dev/diag as diagnostic_device_t
  Resolves: RHEL-95342
  - Allow irqbalance execute shell if irqbalance_run_unconfined is on
  Resolves: RHEL-1556


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.60-1
changelog:
  - Allow irqbalance execute shell if irqbalance_run_unconfined is on
  Resolves: RHEL-1556
  - Update irqbalance policy for using unconfined scripts
  Resolves: RHEL-1556


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.61-1
changelog:
  - Fix incorrect /run and /usr/bin file context entries
  Resolves: SELINUX-4392
  - Dontaudit irqbalance read sssd public files
  Resolves: RHEL-1556
  - Update sssd_dontaudit_read_public_files()
  Resolves: RHEL-1556
  - Allow insights-client file transition for files in /var/tmp
  Resolves: SELINUX-4392
  - Add the virt_exec_virsh() interface
  Resolves: SELINUX-4392
  - Add the ssh_exec_sshd() interface
  Resolves: SELINUX-4392
  - Add rhsmcertd interfaces
  Resolves: SELINUX-4392
  - Add the bind_exec_named_checkconf() interface
  Resolves: SELINUX-4392
  - Add the auth_write_motd_var_run_files() interface
  Resolves: SELINUX-4392
  - Add the gpg_domtrans_agent() interface
  Resolves: SELINUX-4392
  - Add the gpg_read_user_secrets() interface
  Resolves: SELINUX-4392
  - Add policy for insights-core
  Resolves: SELINUX-4392


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.62-1
changelog:
  - Allow "hostapd_cli ping" run as a systemd service
  Resolves: RHEL-59683
  - Allow systemd-timedated start/stop timemaster services
  Resolves: RHEL-95690
  - Allow lldpd connect to systemd-machined over a unix socket
  Resolves: RHEL-96167
  - Allow power-profiles-daemon get attributes of filesystems with extended attributes
  Resolves: RHEL-100718
  - Allow tuned-ppd watch_reads sysfs directories
  Resolves: RHEL-101687
  - Allow tuned-ppd watch sysfs directories
  Resolves: RHEL-101687


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.63-1
changelog:
  - Allow samba-dcerpcd send sigkills to passwd
  Resolves: RHEL-100032
  - Allow power-profiles-daemon watch sysfs directories
  Resolves: RHEL-100718
  - Allow power-profiles-daemon write sysfs files
  Resolves: RHEL-100718
  - Allow hostapd write to socket files in /tmp
  Resolves: RHEL-59683
  - Allow irqbalance search sssd lib directories
  Resolves: RHEL-1556
  - Add insights_client_delete_lib_dirs() interface
  Related: RHEL-59145


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.64-1
changelog:
  - Add insights_core and insights_client interfaces
  Related: RHEL-59145
  - Label /usr/libexec/postfix/tlsproxy with postfix_smtp_exec_t
  Resolves: RHEL-77101
  - Remove "minimum" as a SELINUXTYPE from /etc/selinux/config
  Resolves: RHEL-101140


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.65-1
changelog:
  - Revert "Add policy for insights-core"
  Resolves: RHEL-110650
  - Revert "Add insights_core interfaces"
  Resolves: RHEL-110650


author: Iker Pedrosa <ipedrosa@redhat.com> - 2:4.9-15
changelog:
  - nss.c: shadow_logfd to stderr. Resolves: RHEL-83431
  - vipw: restore the original terminal pgrp after editing. Resolves: RHEL-70844 and RHEL-72940


author: Jan Jansky <jjansky@redhat.com> = 4.10.0-1
changelog:
  - Update to 4.10.0
    Resolves: RHEL-110500
    Resolves: RHEL-110501
    Resolves: RHEL-110502
    Resolves: RHEL-110503


author: Stepan Broz <sbroz@redhat.com> - 1.9.5p2-10.2
changelog:
  RHEL: 9.6.0.Z ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-105595


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.26.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-94808
    - tuned-ppd: renamed thinkpad_function_keys as sysfs_acpi_monitor
    - tuned-ppd: enabled sysfs_acpi_monitor by default
    - tuned-ppd: fixed inotify watch for performance degradation
    - tuned-ppd: pinned virtual files in memory for inotify
    - fixed instance priority inheritance
    - hotplug: added fixes for device remove race condition
    - tuned-main.conf: added startup_udev_settle_wait option
    - functions: silenced errors if module kvm_intel does not exist
      resolves: RHEL-79943
    - functions: make calc_isolated_cores return CPU ranges
      resolves: RHEL-75751
    - scsi: used 'med_power_with_dipm' for SATA ALPM
    - scsi: do not set ALPM on external SATA ports
    - network_latency: Set non-zero rcutree.nohz_full_patience_delay
    - realtime: Disable appropriate P-State drivers
      resolves: RHEL-85637
    - plugin_disk: added support for MMC (MultiMediaCard) devices
    - udev: fix possible traceback in device matcher
    - udev-settle: obey udev buffer size and handle possible tracebacks
    - daemon: re-raise daemon init exception in no-daemon mode
      resolves: RHEL-71304
    - vm: deprecate dirty_ratio in favour of dirty_bytes with percents
      resolves: RHEL-101578
    - gui: fix the profile deleter script


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-22.1
changelog:
  - RHEL-112006 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112010 CVE-2025-53906 vim: Vim path traversal


author: Than Ngo <than@redhat.com> - 2.21-30
changelog:
  - Add a check to ensure that /proc/$$/exe can be read
    thanks to mbliss@redhat.com for the report and the proposed patch
    Resolves: RHEL-101066


author: Than Ngo <than@redhat.com> - 2.21-30
changelog:
  - Add a check to ensure that /proc/$$/exe can be read
    thanks to mbliss@redhat.com for the report and the proposed patch
    Resolves: RHEL-101073


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-7
changelog:
  - xfs unrepairable filesystem if directory block not junked in phase 3 - more
  - fixes
  - Related: RHEL-54342


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-61
changelog:
  - RHEL-32684 - sssd autofs fails to get correct EHOSTDOWN if requested
    incorrect mount after upgrade to sssd-2.9.1-4.el8_9.5.x86_64
    - handle sss special case getautomntbyname() error
  - Resolves: RHEL-32684


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-63
changelog:
  - RHEL-87031 - autofs hang - autofs-5.1.4-114.el8_10.2
    - fix lock ordering deadlock in expire_cleanup().
    - change spec file %patchN to %patch -P N as required by rpm(8).
    - Fix compile error caused by function pointer types in cyrus-sasl module.
    - removed references to patch1 and patch2 due to rbmbuild(8) complaints.
  - Resolves: RHEL-87031


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-64
changelog:
  - RHEL-81885 - autofs: segfault while dereferencing null mapent
    - fix handling of ignored offsets.
    - fix invalidated map entry handling in hosts module.
    - fix changelog revision number of previous change.
  - Resolves: RHEL-81885


author: Ian Kent <ikent@redhat.com> - 1:5.1.7-65
changelog:
  - RHEL-85615 - autofs fails to mount shares when using kerberised LDAP
    - always recreate credential cache.
    - fix always recreate credential cache.
  -Resolves: RHEL-85615


author: Joseph Marrero <jmarrero@redhat.com> - 0.6.3-1
changelog:
  - Rebase to 0.6.3 which is supported upstream
    This release also includes the fix for CVE-2024-42472
    Fixes: #RHEL-56797


author: rhel-developer-toolbox <krenzelok.frantisek@gmail.com> - 2025.2.80_v9.0.305-91
changelog:
  - Update to CKBI 2.80_v9.0.305 from NSS 3.114
  -    Adding:
  -     # Certificate "TWCA CYBER Root CA"
  -     # Certificate "TWCA Global Root CA G2"
  -     # Certificate "SecureSign Root CA12"
  -     # Certificate "SecureSign Root CA14"
  -     # Certificate "SecureSign Root CA15"
  -     # Certificate "D-TRUST BR Root CA 2 2023"
  -     # Certificate "TrustAsia SMIME ECC Root CA"
  -     # Certificate "TrustAsia SMIME RSA Root CA"
  -     # Certificate "TrustAsia TLS ECC Root CA"
  -     # Certificate "TrustAsia TLS RSA Root CA"
  -     # Certificate "D-TRUST EV Root CA 2 2023"
  -     # Certificate "SwissSign RSA SMIME Root CA 2022 - 1"
  -     # Certificate "SwissSign RSA TLS Root CA 2022 - 1"
  -     # Certificate "Sectigo Public Code Signing Root R46"
  -     # Certificate "Sectigo Public Code Signing Root E46"


author: Miroslav Lichvar <mlichvar@redhat.com> 4.6.1-2
changelog:
  - improve description of refresh directive (RHEL-82096)
  - improve logging of selection failures (RHEL-80388 RHEL-80413 RHEL-80415)
  - fix sourcedir reloading to not multiply sources (RHEL-95016)
  - switch from patchX to patch -P X


author: Ondřej Pohořelský <opohorel@redhat.com> - 1.5.7-14
changelog:
  - Rename variables in get_range()
  - Step size out fo bound handling 
  - Fix range parsing
  - Resolves: RHEL-82795


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
changelog:
  - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
  - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-34.1
changelog:
  - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129738 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-36
changelog:
  - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch
  - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch
  - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch
  - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch
  - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch
  - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch
  - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch
  - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch
  - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch
  - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch
  - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch
  - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch
    * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a
      process in another network namespace")
  - Resolves: RHEL-78758


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-37
changelog:
  - Add 0140-multipath-clean-up-find_multipaths-value-names.patch
  - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch
    * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd
      to communicate with a process in another network namespace")
  - Fix multipath_conf_syntax OSCI test.
  - Resolves: RHEL-82307


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-38
changelog:
  - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch
  - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch
  - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch
    * Fixes RHEL-82534 ("multipathd does not monitor multipath devices
      created externally while there are offline paths.")
  - Resolves: RHEL-82534


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-39
changelog:
  - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch
  - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch
  - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch
  - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch
  - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch
    * Fixes RHEL-103109 ("Update multipath builtin config to add new
      device defaults")
  - Resolves: RHEL-103109


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-39.1
changelog:
  - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch
  - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch
  - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch
  - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch
  - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch
  - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch
  - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch
  - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch
  - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch
  - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch
  - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch
  - Add 0161-limpathpersist-redesign-failed-release-workaround.patch
  - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch
  - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch
  - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch
  - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch
  - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch
  - Add 0167-libmultipath-rename-prflag_value-enums.patch
  - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch
  - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch
  - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch
  - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch
  - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch
  - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch
  - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch
  - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch
  - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch
  - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch
  - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch
  - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch
  - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch
  - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch
  - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch
  - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch
  - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch
  - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch
  - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch
  - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch
  - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch
  - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch
  - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch
  - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch
  - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch
  - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch
  - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch
  - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch
  - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch
    * Fixes RHEL-118723 ("There are many bugs in multipath's persistent
      reservation handling [rhel-9.7.z]")
  - Resolves: RHEL-118723


author: Lukáš Zaoral <lzaoral@redhat.com> - 5.3.0-2
changelog:
  - fix intermittent test failures (RHEL-82109)
  - fix source-sh test with non-default manpath (RHEL-82109)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-17
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94483
  - Resolves: RHEL-102844


author: Jan Macku <jamacku@redhat.com> - 20210202-12
changelog:
  - Fix CVE-2025-47268 iputils: Signed Integer Overflow in Timestamp Multiplication in iputils ping (RHEL-94334)


author: Denys Vlasenko <dvlasenk@redhat.com> - 20251111-155.1
changelog:
  - Update linux-firmware to latest upstream (RHEL-128738)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905
  - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy
  - rtw88: 8822b: Update firmware to v30.20.0
  - rtl_nic: add firmware rtl8125k-1
  - ASoC: tas2781: Update dsp firmware for HP and ASUS projects
  - ASoC: tas2781: Update dsp firmware for HP and ASUS projects
  - amdgpu: DMCUB updates for various ASICs
  - amdgpu: DMCUB updates for various ASICs
  - qcom: add SOCCP firmware for kaanapali platform
  - xe: Update GUC to v70.53.0 for BMG, LNL, PTL
  - i915: Update GUC to v70.53.0 for DG2, MTL
  - rtw89: 8851b: update fw to v0.29.41.5
  - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2
  - rtw89: 8852b: update fw to v0.29.29.14
  - Revert "rtw89: 8852b: update fw to v0.29.128.0"
  - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1
  - rtw89: 8852bt: update fw to v0.29.122.1
  - Revert "rtw89: 8852bt: update fw to v0.29.127.0"
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20251015213201
  - rtl_bt: Add firmware and config files for RTL8761CUV
  - linux-firmware: Update AMD cpu microcode
  - qcom: add ADSP firmware for kaanapali platform
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system.
  - mediatek MT7920: update bluetooth firmware to 20251020151255
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7920 WiFi device
  - amd-ucode: Fix minimum revisions in README
  - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID
  - mediatek MT7922: update bluetooth firmware to 20251020143443
  - Revert "linux-firmware: update firmware for MT7922 WiFi device"
  - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659
  - iwlwifi: add Bz/Fm and gl FW for core98-161 release
  - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release
  - iwlwifi: update ty/So/Ma firmwares for core98-161 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release
  - intel: qat: Fix missing link
  - amdgpu: DMCUB updates for various ASICs
  - nvidia: add generic bootloader for GSP-enabled systems
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build
  - qcom: vpu: rename firmware binaries
  - Intel IPU7: Update product signed firmware binary
  - i915: Xe2LPD DMC v2.29
  - i915: Xe3LPD DMC v2.32
  - i915: Xe3LPD_3002 DMC v2.27
  - WHENCE: nvidia: rearrange GSP-RM firmware lines
  - linux-firmware: Add ISH firmware file for Intel Pather Lake platform
  - linux-firmware: Update firmware file for Intel Magnetar core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - qcom: add CDSP firmware for kaanapali platform
  - qcom: add version for A650 GMU firmware
  - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100
  - qcom: Add firmwares for Kaanapali GPU
  - qcom: Update A623 GMU fw
  - qcom: Fix QCS615 chipset's GPU secure fw
  - qcom: Update DSP firmware for sa8775p platform
  - amdgpu: DMCUB updates for various ASICs
  - WHENCE: remove link for Kaanapali video firmware
  - intel_vpu: Update NPU firmware
  - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems
  - Update VCN for Navi1x, Green Sardine and Renoir
  - WHENCE: extract multitech license text
  - WHENCE: extract ueagle license
  - WHENCE: use LICENCE.sensoray for s2255drv
  - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray
  - WHENCE: clean up emi62 and yam license statements
  - qcom: vpu: update video firmware binary for SM8550
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA
  - qcom: vpu: add video firmware for Kaanapali
  - qcom: Update DSP firmware for qcs8300 platform.
  - qcom: Add Audio topology for HAMOA-EVK
  - intel/ish:Add ISH firmware file for Intel Lunar Lake platform
  - mediatek: update firmware version info for MT7986/81/16
  - linux-firmware: ql2500_fw: update ISP25xx Firmware
  - qcom: Update aic100 firmware files
  - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a
  - amdgpu: DMCUB updates for various ASICs
  - mediatek: mtk_wed: drop links for mt7988
  - Revert "amdgpu: update gc 10.3.6 firmware"
  - qcom: Update DSP firmware for qcs8300 platform.
  - powervr: update firmware for Imagination Technologies BXS-4-64 GPU
  - qcom: Update DSP firmware for sa8775p platform.
  - amdgpu: DMCUB updates for various ASICs
  - ath12k: WCN7850 hw2.0: update board-2.bin
  - qcom: move LEMANS EVK firmware to correct location
  - amdgpu: update PSP 14.0.3 kicker firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update VPE 6.1.0 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update SMU 13.0.0 kicker firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update SDMA 6.1.3 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update VPE 6.1.3 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - amdgpu: DMCUB updates for various ASICs
  - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10
  - mediatek MT7922: update bluetooth firmware to 20250903123504
  - linux-firmware: update firmware for MT7922 WiFi device
  - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir
  - qcom: Add Audio topology for MONACO-EVK
  - qcom: add CDSP firmware for qcs615 platform
  - qcom: Add Audio topology for LEMANS-EVK
  - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices.
  - qcom: vpu: update firmware binaries to fix encoder drain handling
  - intel_vpu: Update NPU firmware
  - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers"
  - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers
  - xe: Update GUC to v70.49.4 for BMG, LNL, PTL
  - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL
  - qcom: add ADSP firmware for qcs615 platform
  - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962
  - iwlwifi: add Bz-HR FW for core90-93 release
  - Fix link entry for qat_895xcc.bin
  - Move QAT firmware to intel/ subdirectory
  - Move all iwlwifi top level files to intel/ directory
  - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10"
  - ath11k: Support WCN6855 hw2.1 with NFA firmware variant
  - amdgpu: Update ISP FW for isp v4.1.1
  - Update README.md to clarify S-o-b requirements
  - firmware: qcom: Reorder VPU firmware entries in WHENCE
  - intel_vpu: Update NPU firmware
  - amdgpu: DMCUB updates for various ASICs
  - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10
  - cirrus: cs35l41: Move entries to correct driver section in WHENCE
  - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops
  - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops
  - qcom: Add firmware binary for SM8650.
  - Link rtl8723b_config.bin to rtl8723bs
  - rtw89: 8922a: update fw to v0.35.80.3
  - rtw89: 8852c: update fw to v0.27.129.4
  - rtw89: 8852c: update fw to v0.27.129.3
  - qcom: add CDSP firmware for x1e80100 platform
  - iwlwifi: add Bz/gl FW for core97-84 release
  - iwlwifi: update ty/So/Ma firmwares for core97-84 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release
  - amdgpu: DMCUB updates for various ASICs
  - realtek: rt1321: Add patch firmware of MCU
  - mediatek: Add MT8189 SCP firmware
  Resolves: RHEL-128738


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260107-155.2
changelog:
  - Update linux-firmware to latest upstream (RHEL-139979)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - qcom: Update aic100 firmware files
  - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105
  - firmware: Revert kernel_boot.elf due to license compliance issue
  - linux-firmware: add firmware for an8811hb 2.5G ethernet phy
  - i915: Xe3LPD_3002 DMC v2.28
  - i915: Xe3LPD DMC v2.33
  - intel_vpu: Add firmware for 50xx NPUs and update older ones
  - linux-firmware: Update AMD SEV firmware
  - amdgpu: DMCUB updates for various ASICs
  - qcom: venus-5.4: fix ELF segment alignment to 4 bytes
  - mediatek MT7925: update bluetooth firmware to 20251210093205
  - linux-firmware: update firmware for MT7925 WiFi device
  - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller
  - qcom: Update CDSP firmware for qcm6490 platform
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55
  - linux-firmware: Add firmware file for Intel Scorpius core
  - rtw89: 8852b: update fw to v0.29.29.15
  - cirrus: cs35l41: Update firmware and tuning for various HP laptops
  - cirrus: cs35l41: Add support for new HP Clipper laptop
  - qcom: drop compatibility a640_zap.mdt symlink
  - qcom: add version for a530v3_gpmu.fw2
  - xe: Update GUC to v70.55.3 for BMG, PTL
  - iwlwifi: add Bz/Sc FW for core101-82 release
  - iwlwifi: Add Sc/Gf firmware for core101-82 release
  - iwlwifi: update ty/So/Ma firmwares for core101-82 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release
  - amdgpu: DMCUB updates for various ASICs
  - qcom: Add firmwares for sm8150 GPU
  - qcom: Add firmwares for sm8450 GPU
  - qcom: Add firmwares for sm8550 GPU
  - qcom: Add firmwares for sm8650 GPU
  - qcom: Add firmwares for sm8750 GPU
  - Makefile: add licence header
  - ath10k: WCN3990 hw1.0: update board-2.bin
  - ath10k: QCA9888 hw2.0: update board-2.bin
  - ath10k: QCA4019 hw1.0: update board-2.bin
  - cirrus: cs35l41: Add support for new HP laptops
  - Revert "amdgpu: update GC 11.5.0 firmware"
  - linux-firmware: Update amd-ucode copyright information
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - ath11k: QCA2066 hw2.1: update board-2.bin
  - qcom: update ADSP firmware for x1e80100 platform, change the license
  - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE
  - Reapply "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update GC 10.3.6 firmware"
  - Revert "amdgpu: update GC 11.5.1 firmware"
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20251124093155
  - intel_vpu: Update NPU firmware
  - WHENCE: fix version string for video firmware
  - qcom: vpu: update video firmware binary for SM8250
  - xe: Update GUC to v70.54.0 for BMG, PTL
  - Revert "amdgpu: update GC 11.0.1 firmware"
  - QCA: Add Bluetooth firmware for WCN685x uart interface
  - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3
  - qcom: venus-5.4: update firmware binary for v5.4
  - qcom: venus-5.4: remove unused firmware file
  - iwlwifi: add Sc/Wh FW for core98-181 release
  - amdgpu: DMCUB updates for various ASICs
  - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04
  - ASoC: tas2781: Add more symbol links on SPI devices
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update renoir firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update SMU 14.0.3 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update smu 13.0.0 kicker firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update SDMA 4.4.2 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: add vce1 firmware
  - mediatek MT7922: update bluetooth firmware to 20251118163447
  - linux-firmware: update firmware for MT7922 WiFi device
  - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license
  - qcom: add ADSP, CDSP firmware for sm8750 platform
  - rtl_nic: add firmware rtl9151a-1
  - qcom: Update aic100 firmware files
  - mt76: add firmware for MT7990
  - mt76: update firmware for MT7992
  - mt76: update firmware for MT7996
  - cirrus: cs35l57: Add firmware for a few Dell products
  - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec
  - qcom: Add sdx35 Foxconn vendor firmware image file
  - linux-firmware: Update AMD cpu microcode
  Resolves: RHEL-139979


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.6.1.el9_7]
changelog:
  - pstore/ram: Check start of empty przs during init (CKI Backport Bot) [RHEL-122068] {CVE-2023-53331}
  - ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119074]
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119130] {CVE-2025-39841}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118257] {CVE-2025-39817}
  - SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110810]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110810] {CVE-2025-38571}
  - smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-117880]
  - smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-117880]
  - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-117880] {CVE-2025-39819}
  - sunrpc: fix handling of server side tls alerts (Steve Dickson) [RHEL-111069] {CVE-2025-38566}
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117580] {CVE-2025-39849}
  - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117235] {CVE-2023-53373}
  - ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116187]
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (CKI Backport Bot) [RHEL-116662] {CVE-2022-50367}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-113837] {CVE-2022-50087}
  - hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-115070]
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-115070]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-115070]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-115070]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-115070]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-115070]
  - RDMA/mana_ib: Add device statistics support (Maxim Levitsky) [RHEL-115070]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-115070]
  - net: mana: Fix warnings for missing export.h header inclusion (Maxim Levitsky) [RHEL-115070]
  - net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-115070]
  - s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114451]
  - s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114451]
  - redhat: enable TDX host config (Paolo Bonzini) [RHEL-27146]
  - KVM: TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27146]
  - x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27146]
  - x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Paolo Bonzini) [RHEL-27146]
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114437]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114437]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114437]
  - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86 (Waiman Long) [RHEL-114272]
  - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - randomize_kstack: Remove non-functional per-arch entropy filtering (Waiman Long) [RHEL-114272]
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113917]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.7.1.el9_7]
changelog:
  - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková)
  - crypto: xts - Handle EBUSY correctly (Vladis Dronov) [RHEL-119236] {CVE-2023-53494}
  - ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-112874]
  - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-112874]
  - ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116540]
  - xfs: do not propagate ENODATA disk errors into xattr code (Carlos Maiolino) [RHEL-115730]
  - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116383] {CVE-2025-39702}
  - s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114434]
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114434]
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114298] {CVE-2025-39718}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.8.1.el9_7]
changelog:
  - NFSD: Fix callback decoder status codes (Jay Shin) [RHEL-127193]
  - NFSD: Fix CB_GETATTR status fix (Jay Shin) [RHEL-127193]
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Jay Shin) [RHEL-127193]
  - kernfs: Fix UAF in polling when open file is released (Pavel Reichl) [RHEL-122087] {CVE-2025-39881}
  - gitlab-ci: disable automotive pipelines (Scott Weaver)
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Benjamin Coddington) [RHEL-122154]
  - sched: Add wait/wake interface for variable updated under a lock. (Benjamin Coddington) [RHEL-122154]
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Benjamin Coddington) [RHEL-122154]
  - sched: Document wait_var_event() family of functions and wake_up_var() (Benjamin Coddington) [RHEL-122154]
  - sched: Improve documentation for wake_up_bit/wait_on_bit family of functions (Benjamin Coddington) [RHEL-122154]
  - sched: change wake_up_bit() and related function to expect unsigned long * (Benjamin Coddington) [RHEL-122154]
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} [rhel-9.7.z] (Xin Long) [RHEL-125513]
  - redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-125317]
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123808]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123808] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123808] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123808] {CVE-2025-39970}
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123808] {CVE-2025-39971}
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123808] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123808] {CVE-2025-39973}
  - io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124971] {CVE-2025-40047}
  - Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124129] {CVE-2025-39983}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123821] {CVE-2025-39982}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121704] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121704] {CVE-2025-38498}
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-117136] {CVE-2025-38351}
  - ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-117438]
  - net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-117438]
  - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113855] {CVE-2025-39697}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.9.1.el9_7]
changelog:
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-124651]
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-124651]
  - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
  - slub: Reflow ___slab_alloc() (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
  - nvme-multipath: Skip nr_active increments in RETRY disposition (Ewan D. Milne) [RHEL-123686]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.10.1.el9_7]
changelog:
  - ice: ice_adapter: release xa entry on adapter allocation failure (CKI Backport Bot) [RHEL-128469] {CVE-2025-40185}
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Eder Zulian) [RHEL-125478] {CVE-2025-40058}
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123111] {CVE-2025-39898}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125604] {CVE-2025-38724}
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122874] {CVE-2025-39864}
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (Jay Shin) [RHEL-116680]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.11.1.el9_7]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120668]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120668] {CVE-2025-39955}
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix sparse errors (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix possible UAFs (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - wifi: mt76: free pending offchannel tx frames on wcid cleanup (Jose Ignacio Tornos Martinez) [RHEL-123064]
  - wifi: mt76: do not add non-sta wcid entries to the poll list (Jose Ignacio Tornos Martinez) [RHEL-123064]
  - wifi: mt76: fix linked list corruption (Jose Ignacio Tornos Martinez) [RHEL-123064] {CVE-2025-39918}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.12.1.el9_7]
changelog:
  - x86/hyperv: Fix kdump on Azure CVMs (Li Tian) [RHEL-129776]
  - net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124428] {CVE-2025-39979}
  - octeon_ep: Validate the VF ID (Kamal Heib) [RHEL-117604]
  - dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Handle missing or corrupted flash configuration (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Refactor DPLL initialization (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (Ivan Vecera) [RHEL-113083]
  - dpll: Make ZL3073X invisible (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Fix build failure (Ivan Vecera) [RHEL-113083]
  - redhat/configs: enable CONFIG_ZL3073X* (Ivan Vecera) [RHEL-113083]
  - redhat/configs: enable CONFIG_I2C_MUX_PCA954x on x86 (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get fractional frequency offset (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to adjust phase (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement phase offset monitor feature (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get phase offset on connected input pin (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set esync on pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set frequency on pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement input pin state setting in automatic mode (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set priority on input pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement input pin selection in manual mode (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Register DPLL devices and pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Read DPLL types and pin properties from system firmware (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Fetch invariants during probe (Ivan Vecera) [RHEL-113083]
  - dpll: Add basic Microchip ZL3073x support (Ivan Vecera) [RHEL-113083]
  - spi: Introduce spi_get_device_match_data() helper (Ivan Vecera) [RHEL-113083]
  - dt-bindings: dpll: Add support for Microchip Azurite chip family (Ivan Vecera) [RHEL-113083]
  - dt-bindings: dpll: Add DPLL device and pin (Ivan Vecera) [RHEL-113083]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.13.1.el9_7]
changelog:
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124105] {CVE-2025-39925}
  - can: j1939: implement NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124105] {CVE-2025-39925}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.15.1.el9_7]
changelog:
  - nbd: override creds to kernel when calling sock_{send,recv}msg() (Ming Lei) [RHEL-123845]
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-127982]
  - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-127982]
  - crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix SNP panic notifier unregistration (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix dereferencing uninitialized error pointer (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix __sev_snp_shutdown_locked (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Move SEV/SNP Platform initialization to KVM (Lenny Szubowicz) [RHEL-70006]
  - KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Add new SEV/SNP platform shutdown API (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Register SNP panic notifier only if SNP is enabled (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Reset TMR size at SNP Shutdown (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Lenny Szubowicz) [RHEL-70006]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.16.1.el9_7]
changelog:
  - CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129261] {CVE-2025-38499}
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128860] {CVE-2025-40176}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.17.1.el9_7]
changelog:
  - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126165]
  - smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124917]
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119150] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.18.1.el9_7]
changelog:
  - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-134237]
  - redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.19.1.el9_7]
changelog:
  - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-133543]
  - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-133543]
  - audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119176] {CVE-2025-39840}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.20.1.el9_7]
changelog:
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124607] {CVE-2025-39806}
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134001] {CVE-2025-40240}
  - selftests/landlock: Add a new test for setuid() (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Split signal_scoping_threads tests (Štěpán Horáček) [RHEL-132712]
  - landlock: Always allow signals between threads of the same process (Štěpán Horáček) [RHEL-132712]
  - landlock: Prepare to add second errata (Štěpán Horáček) [RHEL-132712]
  - landlock: Add the errata interface (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Test signal scoping for threads (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Test signal scoping (Štěpán Horáček) [RHEL-132712]
  - landlock: Add signal scoping (Štěpán Horáček) [RHEL-132712]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.21.1.el9_7]
changelog:
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137147] {CVE-2025-68287}
  - redhat: conflict with unsupported shim on x86/aarch64 (9.7.z) (Li Tian) [RHEL-135775]
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134428] {CVE-2025-40277}
  - perf tools: Don't set attr.exclude_guest by default (Michael Petlan) [RHEL-131726]
  - smb: client: fix refcount leak in smb2_set_path_attr (Paulo Alcantara) [RHEL-127422]
  - smb: client: fix potential UAF in smb2_close_cached_fid() (Paulo Alcantara) [RHEL-127422]
  - smb: client: fix potential cfid UAF in smb2_query_info_compound (Paulo Alcantara) [RHEL-127422]
  - smb: client: Fix refcount leak for cifs_sb_tlink (Paulo Alcantara) [RHEL-127422]
  - cifs: parse_dfs_referrals: prevent oob on malformed input (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove cfids_invalidation_worker (Paulo Alcantara) [RHEL-127422]
  - smb client: fix bug with newly created file in cached dir (Paulo Alcantara) [RHEL-127422]
  - smb: client: short-circuit negative lookups when parent dir is fully cached (Paulo Alcantara) [RHEL-127422]
  - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove pointless cfid->has_lease check (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove unused fid_lock (Paulo Alcantara) [RHEL-127422]
  - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (Paulo Alcantara) [RHEL-127422]
  - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (Paulo Alcantara) [RHEL-127422]
  - smb: client: account smb directory cache usage and per-tcon totals (Paulo Alcantara) [RHEL-127422]
  - smb: client: add drop_dir_cache module parameter to invalidate cached dirents (Paulo Alcantara) [RHEL-127422]
  - smb: client: show lease state as R/H/W (or NONE) in open_files (Paulo Alcantara) [RHEL-127422]
  - smb: client: show negotiated cipher in DebugData (Paulo Alcantara) [RHEL-127422]
  - smb: client: add new tracepoint to trace lease break notification (Paulo Alcantara) [RHEL-127422]
  - smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() (Paulo Alcantara) [RHEL-127422]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.22.1.el9_7]
changelog:
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137400] {CVE-2025-68285}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.23.1.el9_7]
changelog:
  - book3s64/hash: Remove kfence support temporarily (Mamatha Inamdar) [RHEL-135574]
  - xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-135714]
  - xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-135714]
  - inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-116121]
  - ipv4/route: avoid unused-but-set-variable warning (Guillaume Nault) [RHEL-116121]
  - arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-130734]
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-130734]
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-130734]
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-130734]
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-130734]
  - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386 (Waiman Long) [RHEL-130734]
  - arm64: errata: Expand speculative SSBS workaround once more (Waiman Long) [RHEL-130734]
  - arm64: errata: Expand speculative SSBS workaround (again) (Waiman Long) [RHEL-130734]
  - tools headers arm64: Sync arm64's cputype.h with the kernel sources (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Neoverse-N3 definitions (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-A725 definitions (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-X1C definitions (Waiman Long) [RHEL-130734]
  - drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttilä) [RHEL-122263] {CVE-2025-38703}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.24.1.el9_7]
changelog:
  - gitlab-ci: use rhel9.7 builder image (Michael Hofmann)
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131388] {CVE-2025-39933}
  - tty: n_tty: Fix buffer offsets when lookahead is used (Radostin Stoyanov) [RHEL-130039]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.25.1.el9_7]
changelog:
  - ice: Fix kernel panic due to page refcount underflow (Mohammad Heib) [RHEL-139731]
  - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487] {CVE-2025-68301}
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134767]
  - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138493]
  - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284] {CVE-2025-40248}
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035] {CVE-2025-38349}
  - block: don't freeze queue for updating queue limits (Ming Lei) [RHEL-135268]
  - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}
  - uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133868]
  - dpll: zl3073x: Specify phase adjustment granularity for pins (Ivan Vecera) [RHEL-129504]
  - dpll: add phase-adjust-gran pin attribute (Ivan Vecera) [RHEL-129504]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.26.1.el9_7]
changelog:
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462] {CVE-2025-68305}
  - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964] {CVE-2025-40294}
  - drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.27.1.el9_7]
changelog:
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136822] {CVE-2025-38568}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134923] {CVE-2025-40251}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129112] {CVE-2025-40154}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.28.1.el9_7]
changelog:
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133337]
  - s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133337]
  - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137098] {CVE-2025-40271}
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136256] {CVE-2025-40318}
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134352] {CVE-2025-38022}
  - cifs: Fix deadlock in cifs_writepages during reconnect (Paulo Alcantara) [RHEL-134234]
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131974] {CVE-2025-37819}
  - net: openvswitch: fix nested key length validation in the set() action (CKI Backport Bot) [RHEL-131801] {CVE-2025-37789}
  - md: avoid repeated calls to del_gendisk (Nigel Croxon) [RHEL-126532]
  - md: delete mddev kobj before deleting gendisk kobj (Nigel Croxon) [RHEL-126532]
  - md: add legacy_async_del_gendisk mode (Nigel Croxon) [RHEL-126532]
  - md: Don't clear MD_CLOSING until mddev is freed (Nigel Croxon) [RHEL-126532]
  - md: fix create on open mddev lifetime regression (Nigel Croxon) [RHEL-126532]
  - md: call del_gendisk in control path (Nigel Croxon) [RHEL-126532]
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128891] {CVE-2025-40141}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.29.1.el9_7]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138015] {CVE-2025-38415}
  - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138015] {CVE-2025-38415}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137364] {CVE-2025-39760}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137069] {CVE-2025-38024}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.30.1.el9_7]
changelog:
  - io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137329] {CVE-2025-38730}
  - io_uring/kbuf: add io_kbuf_commit() helper (Jeff Moyer) [RHEL-137329]
  - io_uring/kbuf: use 'bl' directly rather than req->buf_list (Jeff Moyer) [RHEL-137329]
  - ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143296]
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Adrian Moreno) [RHEL-141404]
  - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137601] {CVE-2025-38459}
  - dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139699]
  - dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139699]
  - dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139699]
  - dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139699]
  - dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139699]
  - dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139699]
  - dpll: add reference sync get/set (Ivan Vecera) [RHEL-139699]
  - dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139699]
  - dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139699]
  - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129084] {CVE-2025-40170}
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-129084]
  - net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (Hangbin Liu) [RHEL-129084]
  - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129018] {CVE-2025-40135}
  - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128982] {CVE-2025-40158}
  - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128982]
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128982]
  - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128982]
  - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128982]
  - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 (Hangbin Liu) [RHEL-128982]
  - vrf: Fix lockdep splat in output path (Hangbin Liu) [RHEL-128982]
  - ipv6: remove nexthop_fib6_nh_bh() (Hangbin Liu) [RHEL-128982]
  - net: remove rcu_dereference_bh_rtnl() (Hangbin Liu) [RHEL-128982]
  - neighbour: switch to standard rcu, instead of rcu_bh (Hangbin Liu) [RHEL-128982]
  - ipv6: flowlabel: do not disable BH where not needed (Hangbin Liu) [RHEL-128982]
  - ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() (Hangbin Liu) [RHEL-128982]
  - neigh: introduce neigh_confirm() helper function (Hangbin Liu) [RHEL-128982]
  - net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-132923]
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137697] {CVE-2025-38403}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136909] {CVE-2025-40269}
  - nvme: tcp: Fix compilation warning with W=1 (John Meneghini) [RHEL-129928]
  - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (John Meneghini) [RHEL-129928]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.31.1.el9_7]
changelog:
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144332] {CVE-2026-22998}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.32.1.el9_7]
changelog:
  - svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142790] {CVE-2025-68811}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140260] {CVE-2025-68349}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.33.1.el9_7]
changelog:
  - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141877]
  - x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT (Paolo Bonzini) [RHEL-128030]
  - x86/sev: Evict cache lines during SNP memory validation (Paolo Bonzini) [RHEL-128030]
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132891] {CVE-2023-53034}
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137683] {CVE-2025-40304}
  - crypto: iaa - Optimize rebalance_wq_table() (Jay Shin) [RHEL-137272]
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136942] {CVE-2025-40322}
  - bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135137]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.34.1.el9_7]
changelog:
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-145183]
  - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-127498]
  - smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-127498]
  - smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-127498]
  - cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-127498]
  - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126890] {CVE-2025-40064}


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [1-1.el9_7]
changelog:
  - kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns [RHEL-132494] {CVE-2025-38499}


author: Jorge San Emeterio Villalain <jsanemet@redhat.com> [1-2.el9_7]
changelog:
  - kernel: libceph: fix potential use-after-free in have_mon_and_osd_map() [RHEL-140656] {CVE-2025-68285}


author: Karel Zak <kzak@redhat.com> 2.37.4-21.el9_7
changelog:
  - fix RHEL-134269 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-133955 - login-utils: fix setpwnam() buffer use [CVE-2025-14104]


author: Tomas Halman <thalman@redhat.com - 2.9.7.4.1
changelog:
  - Resolves: RHEL-120298 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation
    on AD-joined Linux systems


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.1
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131580)
  - CVE-2025-65018: heap buffer overflow (RHEL-131593)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133287)


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-16
changelog:
  - Fix CVE-2025-5987
    Resolves: RHEL-130051
  - Workaround sshd failure rate limiting in tests
    Resolves: RHEL-135506


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250512-1
changelog:
  - Add a caveat to provide ability to persistently disable SPR-EE updates
    beyond 0x2b0005c0 on systems where absence of latency spikes
    is more important than lack of the latest CVE mitigations.
  - Update Intel CPU microcode to microcode-20250512 release, addresses
    CVE-2024-28956, CVE-2025-20103, CVE-2025-20054, CVE-2024-43420,
    CVE-2025-20623, CVE-2024-45332, CVE-2025-24495, CVE-2025-20012
    (RHEL-94294, RHEL-91231, RHEL-91224, RHEL-91224, RHEL-91239)
    - Addition of 06-8f-04/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-06/0x10 microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2c0003f7;
    - Addition of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-06-8f-08/intel-ucode/06-8f-08) at revision 0x2b000639;
    - Addition of 06-ad-01/0x20 (GNR-AP/SP H0) microcode at revision
      0xa0000d1;
    - Addition of 06-ad-01/0x95 (GNR-AP/SP B0) microcode at revision
      0x10003a2;
    - Addition of 06-b5-00/0x80 (ARL-U A1) microcode at revision 0xa;
    - Addition of 06-bd-01/0x80 (LNL B0) microcode at revision 0x11f;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode (in
      intel-ucode/06-c5-02) at revision 0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c5-02) at
      revision 0x118;
    - Addition of 06-c5-02/0x82 (ARL-H A1) microcode (in
      intel-ucode/06-c6-02) at revision 0x118;
    - Addition of 06-c6-02/0x82 (ARL-HX 8P/S B0) microcode at revision
      0x118;
    - Addition of 06-c6-04/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Addition of 06-ca-02/0x82 microcode (in intel-ucode/06-c6-02) at
      revision 0x118;
    - Update of 06-8c-01/0x80 (TGL-UP3/UP4 B1) microcode (in
      intel-06-8c-01/intel-ucode/06-8c-01) from revision 0xb8 up to 0xbc;
    - Update of 06-8e-0c/0x94 (AML-Y 4+2 V0, CML-U 4+2 V0, WHL-U V0)
      microcode (in intel-06-8e-9e-0x-dell/intel-ucode/06-8e-0c) from
      revision 0xfc up to 0x100;
    - Update of 06-9e-0d/0x22 (CFL-H/S/Xeon E R0) microcode (in
      intel-06-8e-9e-0x-dell/intel-ucode/06-9e-0d) from revision 0x102 up
      to 0x104;
    - Update of 06-55-07/0xbf (CLX-SP/W/X B1/L1) microcode from revision
      0x5003707 up to 0x5003901;
    - Update of 06-55-0b/0xbf (CPX-SP A1) microcode from revision 0x7002904
      up to 0x7002b01;
    - Update of 06-6a-06/0x87 (ICX-SP D0) microcode from revision 0xd0003f5
      up to 0xd000404;
    - Update of 06-6c-01/0x10 (ICL-D B0) microcode from revision 0x10002c0
      up to 0x10002d0;
    - Update of 06-7a-08/0x01 (GLK-R R0) microcode from revision 0x24 up
      to 0x26;
    - Update of 06-7e-05/0x80 (ICL-U/Y D1) microcode from revision 0xc6
      up to 0xca;
    - Update of 06-8c-02/0xc2 (TGL-R C0) microcode from revision 0x38 up
      to 0x3c;
    - Update of 06-8d-01/0xc2 (TGL-H R0) microcode from revision 0x52 up
      to 0x56;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode from revision
      0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode (in intel-ucode/06-8f-05) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-05) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x10 microcode (in intel-ucode/06-8f-06) from
      revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x10 (SPR-HBM B1) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x10 microcode from revision 0x2c0003e0 up to
      0x2c0003f7;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode from revision 0x2b000620
      up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x10 (SPR-HBM B3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2c0003e0 up to 0x2c0003f7;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-06) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-04/0x87 (SPR-SP E0/S1) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-05/0x87 (SPR-SP E2) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-06/0x87 (SPR-SP E3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-8f-07/0x87 (SPR-SP E4/S2) microcode from revision
      0x2b000620 up to 0x2b000639;
    - Update of 06-8f-08/0x87 (SPR-SP E5/S3) microcode (in
      intel-ucode/06-8f-07) from revision 0x2b000620 up to 0x2b000639;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode from revision
      0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-97-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-97-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode from revision 0x38
      up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-97-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-97-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode from revision
      0x436 up to 0x437;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode (in
      intel-ucode/06-9a-03) from revision 0x436 up to 0x437;
    - Update of 06-9a-03/0x80 (ADL-P 6+8/U 9W L0/R0) microcode (in
      intel-ucode/06-9a-04) from revision 0x436 up to 0x437;
    - Update of 06-9a-04/0x40 (AZB A0) microcode from revision 0x9 up
      to 0xa;
    - Update of 06-9a-04/0x80 (ADL-P 2+8 R0) microcode from revision 0x436
      up to 0x437;
    - Update of 06-a5-02/0x20 (CML-H R1) microcode from revision 0xfc up
      to 0x100;
    - Update of 06-a5-03/0x22 (CML-S 6+2 G1) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a5-05/0x22 (CML-S 10+2 Q0) microcode from revision 0xfc
      up to 0x100;
    - Update of 06-a6-00/0x80 (CML-U 6+2 A0) microcode from revision 0xfe
      up to 0x102;
    - Update of 06-a6-01/0x80 (CML-U 6+2 v2 K1) microcode from revision
      0xfc up to 0x100;
    - Update of 06-a7-01/0x02 (RKL-S B0) microcode from revision 0x63 up
      to 0x64;
    - Update of 06-aa-04/0xe6 (MTL-H/U C0) microcode from revision 0x20
      up to 0x24;
    - Update of 06-af-03/0x01 (SRF-SP C0) microcode from revision 0x3000330
      up to 0x3000341;
    - Update of 06-b7-01/0x32 (RPL-S B0) microcode from revision 0x12c up
      to 0x12f;
    - Update of 06-b7-04/0x32 microcode (in intel-ucode/06-b7-01) from
      revision 0x12c up to 0x12f;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode from revision
      0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-02) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-02) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-03) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode from revision 0x4124
      up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode (in intel-ucode/06-ba-03) from
      revision 0x4124 up to 0x4128;
    - Update of 06-ba-02/0xe0 (RPL-H 6+8/P 6+8 J0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-03/0xe0 (RPL-U 2+8 Q0) microcode (in
      intel-ucode/06-ba-08) from revision 0x4124 up to 0x4128;
    - Update of 06-ba-08/0xe0 microcode from revision 0x4124 up to 0x4128;
    - Update of 06-be-00/0x19 (ADL-N A0) microcode from revision 0x1c up
      to 0x1d;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-02) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode (in intel-ucode/06-bf-02)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-02) from
      revision 0x38 up to 0x3a;
    - Update of 06-97-02/0x07 (ADL-HX/S 8+8 C0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-97-05/0x07 (ADL-S 6+0 K0) microcode (in
      intel-ucode/06-bf-05) from revision 0x38 up to 0x3a;
    - Update of 06-bf-02/0x07 (ADL C0) microcode (in intel-ucode/06-bf-05)
      from revision 0x38 up to 0x3a;
    - Update of 06-bf-05/0x07 (ADL C0) microcode from revision 0x38 up
      to 0x3a;
    - Update of 06-bf-06/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-bf-07/0x07 microcode (in intel-ucode/06-bf-05) from
      revision 0x38 up to 0x3a;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode from revision 0x21000291
      up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode (in
      intel-ucode/06-cf-01) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-01/0x87 (EMR-SP A0) microcode (in
      intel-ucode/06-cf-02) from revision 0x21000291 up to 0x210002a9;
    - Update of 06-cf-02/0x87 (EMR-SP A1) microcode from revision 0x21000291
      up to 0x210002a9.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250812-1.20251111-1
changelog:
  - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config
  - Update Intel CPU microcode to microcode-20251111 release (RHEL-128260)
  - New microcode files (in hex):
    06-ae-01: Granite Rapids-D: revision 1000273
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650
    06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410
    06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650
    06-97-02/07: Alder Lake: 003a to 003d
    06-97-05/07: Alder Lake: 003a to 003d
    06-9a-03/80: Alder Lake-L: 0437 to 043a
    06-9a-04/80: Alder Lake-L: 0437 to 043a
    06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b
    06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0
    06-ad-01/20: Granite Rapids-X: a000100 to a000124
    06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382
    06-b7-01/32: Raptor Lake: 012f to 0132
    06-ba-02/e0: Raptor Lake-P: 4129 to 6133
    06-ba-03/e0: Raptor Lake-P: 4129 to 6133
    06-bd-01/80: Lunar Lake: 0123 to 0125
    06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e
    06-bf-02/07: Raptor Lake-S: 003a to 003d
    06-bf-05/07: Raptor Lake-S: 003a to 003d
    06-c5-02/82: Arrow Lake-H: 0119 to 011a
    06-c6-02/82: Arrow Lake: 0119 to 011a
    06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0
  - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147:
    "REP SCASB, REP CMPSB may return incorrect results when racing
    memory access with another core or thread" on Raptor Lake,
    Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids.


author: Phil Sutter <psutter@redhat.com> [1.0.9-5.el9]
changelog:
  - tests: py: missing json output in never merge across non-expression statements (Phil Sutter) [RHEL-114095]
  - tests: py: add missing json.output data (Phil Sutter) [RHEL-114095]
  - tests: py: remove huge-limit test cases (Phil Sutter) [RHEL-114095]
  - datatype: rt_symbol_table_init() to search for iproute2 configs (Phil Sutter) [RHEL-114095]
  - tests: shell: connect chains to hook point (Phil Sutter) [RHEL-114095]
  - tests: shell: Fix sets/reset_command_0 for current kernels (Phil Sutter) [RHEL-114095]


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-47
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128401
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128392


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-7
changelog:
  - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
    CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
    CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
    Resolves: RHEL-142068
    Resolves: RHEL-142002
    Resolves: RHEL-142055
    Resolves: RHEL-142051
    Resolves: RHEL-142047
    Resolves: RHEL-142043
    Resolves: RHEL-142039
    Resolves: RHEL-142035
    Resolves: RHEL-142031
    Resolves: RHEL-142011
    Resolves: RHEL-142027
    Resolves: RHEL-142023


author: Miro Hrončok <mhroncok@redhat.com> - 1.26.5-6.1
changelog:
  - Security fix for CVE-2025-66471
  - Security fix for CVE-2025-66418
  - Security fix for CVE-2026-21441
  Resolves: RHEL-139401


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.1
changelog:
  - meson: /etc/systemd/network is also used by udevd (RHEL-111611)
  - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954)
  - test-time-util: disable failing tests (RHEL-110954)
  - test: test parse_timestamp() in various timezone (RHEL-110954)
  - systemctl: logind: add missing asserts (RHEL-110954)
  - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954)
  - systemctl: add option --when for scheduled shutdown (RHEL-110954)
  - test-time-util: add test cases to invalidate "show" and "cancel" (RHEL-110954)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-111630)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-111630)
  - core: do not disconnect from bus when failed to install signal match (RHEL-111630)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630)
  - core/manager: drop duplicate bus track deserialization (RHEL-111630)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.2
changelog:
  - Revert "test-time-util: disable failing tests" (RHEL-110954)
  - test: use get_timezones() to iterate all known timezones (RHEL-110954)
  - test-time-util: do not fail on DST change (RHEL-110954)
  - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954)
  - test-time-util: do more suppression of time zone checks (RHEL-110954)
  - test-time-util: fix truncation of usec to sec (RHEL-110954)
  - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954)
  - meson: extend timeout for test-time-util (RHEL-110954)
  - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954)
  - time-util: align string table (RHEL-110954)
  - time-util: rename variables (RHEL-110954)
  - time-util: add assertions (RHEL-110954)
  - time-util: drop redundant else (RHEL-110954)
  - time-util: do not use strdupa() (RHEL-110954)
  - time-util: use result from startswith_no_case() (RHEL-110954)
  - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954)
  - time-util: shorten code a bit (RHEL-110954)
  - time-util: rename variables (RHEL-110954)
  - time-util: drop unnecessary assignment of timezone name (RHEL-110954)
  - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954)
  - time-util: fix typo (RHEL-110954)
  - ci: bump the tools tree to F42 (RHEL-110954)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.4
changelog:
  - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294)
  - cryptsetup: fix typo (RHEL-118294)
  - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294)
  - basic: add PIDFS magic (#31709) (RHEL-118294)
  - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294)
  - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138)
  - coredump: restore compatibility with older patterns (RHEL-104138)
  - coredump: use %d in kernel core pattern (RHEL-104138)
  - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138)
  - fd-util: introduce parse_fd() (RHEL-104138)
  - coredump: add support for new %F PIDFD specifier (RHEL-104138)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.5
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022)
  - test: check the next elapse timer timestamp after deserialization (RHEL-127022)
  - timer: don't run service immediately after restart of a timer (RHEL-127022)
  - test: store and compare just the property value (RHEL-127022)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-13
changelog:
  RHEL: 9.7.0 ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-71916
  - CVE-2025-32462 sudo: LPE via host option
  Resolves: RHEL-100020


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-8
changelog:
  - Backport upstream changes to jailify extraction directory
    Includes related gnulib changes to add openat2
    Fixes CVE-2025-45582


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-9
changelog:
  - Fix the last patch to solve a regression with -x and --xattrs: RHEL-136277
    also, fix another tiny mistake in the patch (w/o visible consequences)


author: John Kacur <jkacur@redhat.com> - 0.19-8
changelog:
  - Fix show_threads -t and show_irqs -q to not match everything if no match
  - Fix run command failing to apply BATCH policy
  - Add -U and -K to the move command
  Resolves: RHEL-86862 RHEL-106065 RHEL-106066


author: John B. Wyatt IV <jwyatt@redhat.com> - 0.19-9
changelog:
  - Disable cpu_power from showing in help menu and checking for cpu_power
  match functionality.
  Resolves: RHEL-107847


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-23
changelog:
  - RHEL-112005 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112009 CVE-2025-53906 vim: Vim path traversal


author: Vladimír Beneš <vbenes@redhat.com>- 1:1.54.1-1
changelog:
  - Update to 1.54.1
  - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954)
  - Fix connection.autoconnect-ports of OVS ports (RHEL-114200)
  - Global DNS config without domains silently ignored from D-Bus (RHEL-115973)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.54.2-1
changelog:
  - Update to 1.54.2
  - Support setting protocol version of HSR/PRP (RHEL-122172)
  - Support interlink for HSR/PRP (RHEL-122175)
  - Improve logging of networking off (RHEL-122173 )
  - Don't delete unrelated OVS ports (RHEL-121104)


author: Sumit Bose <sbose@redhat.com> - 0.9.3.1-1
changelog:
  - Rebase to latest upstream version
    Resolves: RHEL-134944
    Resolves: RHEL-134945
    Resolves: RHEL-134946
    Resolves: RHEL-134947
    Resolves: RHEL-134948
    Resolves: RHEL-134950
    Resolves: RHEL-134951
    Resolves: RHEL-134952


author: Sumit Bose <sbose@redhat.com> - 0.9.3.1-2
changelog:
  - Add explicit selinux dependencies to avoid policycoreutils-python-utils dependency
    Resolves: RHEL-134944


author: Packit <hello@packit.dev> - 350-1
changelog:
  - networking: fix renaming of bridges and other groups (RHEL-117883)
  - bridge: fix OpenSSH_10.2p1 host key detection


author: Ondřej Pohořelský <opohorel@redhat.com> - 1.5.7-16
changelog:
  - Forward XDG_SESSION_CLASS to PAM for session classification
  - Also use systemd_tmpfiles to create files in /var, to ensure Cronie
  - works properly in Image mode
  - Resolves: RHEL-131190, RHEL-136491, RHEL-136492


author: Kristina Hanicova <khanicov@redhat.com> - 2.8.1-3
changelog:
  - patch: Read integrity profile info from top level device.
  - patch: Fix possible use of uninitialized variable.
  - patch: Reinstate pbkdf serialization flag in device activation.
  - patch: Fix LUKS2 device status in inline HW mode and detached header.
  - patch: Set inline integrity flag if no underlying dm-integrity device.
  - patch: Fix wrong device size status reports in cryptsetup and integritysetup.
  - Resolves: RHEL-122297 RHEL-125152 RHEL-125167 RHEL-132585 RHEL-140106


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-35
changelog:
  - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-37
changelog:
  - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-40
changelog:
  - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch
  - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch
  - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch
  - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch
  - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch
  - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch
  - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch
  - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch
  - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch
  - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch
  - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch
  - Add 0161-limpathpersist-redesign-failed-release-workaround.patch
  - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch
  - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch
  - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch
  - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch
  - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch
  - Add 0167-libmultipath-rename-prflag_value-enums.patch
  - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch
  - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch
  - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch
  - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch
  - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch
  - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch
  - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch
  - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch
  - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch
  - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch
  - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch
  - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch
  - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch
  - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch
  - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch
  - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch
  - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch
  - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch
  - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch
  - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch
  - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch
  - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch
  - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch
  - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch
  - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch
  - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch
  - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch
    * Fixes RHEL-118515 ("There are many bugs in multipath's persistent
      reservation handling")
  - Resolves: RHEL-118515


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-41
changelog:
  - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch
  - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch
    * Fixes RHEL-118515 ("There are many bugs in multipath's persistent
      reservation handling")
  - Resolves: RHEL-118515


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-42
changelog:
  - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch
    * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat
      storage [rhel-9]")
  - Resolves: RHEL-128396


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-43
changelog:
  - Add 0198-multipathd-print-path-offline-message-even-without-a.patch
    * Fixes RHEL-133814 ("log_checker_err is not printing messages
      repeatedly for failed path [rhel-9]")
  - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch
  - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch
  - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch
  - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch
  - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch
  - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch
  - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch
    * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error
      "Could not open '/dev/dm-95': No such file or directory")
  - Resolves: RHEL-133814
  - Resolves: RHEL-135904


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-44
changelog:
  - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch
  - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch
    * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd
      [rhel-9]")
  - Resolves: RHEL-141291


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-45
changelog:
  - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch
  - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch
  - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch
    * Fixes RHEL-148462 ("Improve multipathd's handling of updating
      persistent reservations on restored paths. [rhel-9]")
  - Resolves: RHEL-148462


author: Ales Matej <amatej@redhat.com> - 4.14.0-33
changelog:
  - autoremove: when a dangling protected dependency is found produce a wanrning
    and skip it (RHEL-76112)


author: Pavel Valena <pvalena@redhat.com> - 057-110.git20260130
changelog:
  - fix(systemd-repart): allow partition format
  - feat(install.d):according to the changes of
  - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded
  - fix(pcsc): add opensc load module file
  - fix(pcsc): add --disable-polkit to pcscd.service
  - fix(pkcs11): delete trailing dot on
  - fix(multipath): disable user_friendly_names with mpathconf
    Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322


author: Eric Garver <egarver@redhat.com> - 1.3.4-17
changelog:
  - fix(server): load firewall rules before claiming dbus
  - fix(nftables): ipset: add entries from GLib loop when idle
  - fix(systemd): Requires dbus


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.3-10
changelog:
  - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
  - Fix name constraint processing performance issue (CVE-2025-14831)


author: Therese Cornell <tcornell@redhat.com> - 2.06-114.1
changelog:
  - Fixes CVE-2025-61662 Missing unregister call for gettext command may lead to use-after-free
  - Resolves: #RHEL-141593


author: Josue Hernandez <josherna@redhat.com> 2.06-114.2
changelog:
  - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size
  - Resolves: #RHEL-155284


author: Nicolas Frayer <nfrayer@redhat.com> 2.06-122
changelog:
  - Fix several security issues about module unloading and file handling
  - Resolved: #RHEL-141594
  - Resolves: #CVE-2025-54771 #CVE-2025-61661
  - Resolves: #CVE-2025-61662 #CVE-2025-61663 #CVE-2025-61664


author: Josue Hernandez <josherna@redhat.com> 2.06-126
changelog:
  - kern/efi/mm: Change grub_efi_mm_add_regions() to keep track of map allocation size
  - Resolves: #RHEL-148310


author: Kamal Heib <kheib@redhat.com> - 60.0-1
changelog:
  - Rebase to upstream release v60.0
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-2
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-3
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 61.0-1
changelog:
  - Rebase to upstream release v61.0
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Tony Camuso <tcamuso@redhat.com> - 25.04-1
changelog:
  - Update to latest upstream.
  - Clean up install paths, drop obsolete patches, and improve flag injection
  handling
  - Replaced hard-coded install paths in Makefiles with sed-based DESTDIR
    fixes for lib, pqos, rdtset, and membw
    - Using sed during %prep is more robust and version-agnostic than patching,
      which requires rebasing each release
  - Relocated admin tools (pqos*, rdtset) from /usr/bin to /usr/sbin for FHS
    compliance
    - These tools require root and interact with system-level cache controls
  - Updated %files to match SONAME bump (libpqos.so.5 -> libpqos.so.6) introduced
    upstream
  - Dropped patches 0001, 0002, 0004, 0005
    - 0001/0002 replaced by sed
  - Ensure CFLAGS and LDFLAGS are augmented, not overridden by using sed to
    convert assignments to +=
    - Ensures compatibility with distro-injected flags (e.g. -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m32 -march=i686 -mtune=generic -msse2 -mfpmath=sse -mstackrealign -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection,
      hardening) without carrying a version-specific patch
    Resolves: RHEL-122380


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260130-155.3
changelog:
  - Update linux-firmware to latest upstream (RHEL-145523)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
  - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops
  - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops
  - Intel IPU7: Update firmware binary for Panther Lake
  - linux-firmware: update firmware for MT7921 WiFi device
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F
  - linux-firmware: Add firmware for airoha-npu-7583 driver
  - iwlwifi: add Bz/Sc FW for core102-56 release
  - iwlwifi: Add Hr/Gf firmware for core102-56 release
  - iwlwifi: update ty/So/Ma firmwares for core102-56 release
  - xe: Add GSC 105.0.2.1301 for PTL
  - mediatek: rename MT8188 SCP firmware
  - qcom: Update DSP firmware for QCM6490 platform
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20260106153314
  - mediatek MT7920: update bluetooth firmware to 20260105151350
  - mediatek MT7922: update bluetooth firmware to 20260106153735
  - linux-firmware: update firmware for MT7922 WiFi device
  - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900
  - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0
  - qcom: Update DSP firmware for sa8775 platform
  - QCA: Add Bluetooth firmware for QCC2072 uart interface
  - i915: Xe3p_LPD DMC v2.33
  - qcom: Update DSP firmware for qcs8300 platform
  - linux-firmware: update firmware for MT7920 WiFi device
  Resolves: RHEL-145523


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260311-155.4
changelog:
  - Update linux-firmware to latest upstream (RHEL-154360)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: DMCUB updates for various ASICs
  - qcom: add QUPv3 firmware for QCS615 platform
  - Add LENOVO ISH firmware v5.8.0.7720 for X9-15 2025
  - mediatek MT7922: update bluetooth firmware to 20260224103448
  - linux-firmware: update firmware for MT7922 WiFi device
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
  - cirrus: cs35l63: Add firmware for Cirrus CS35L63 for various Dell laptops
  - linux-firmware: Remove duplicate fw and Rename Lenovo ISH LNLM firmware files accordingly
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Add firmware file for Intel BlazarIGfp2 core
  - QCA: Update Bluetooth QCA6698 firmware to 2.1.2-00069
  - qcom: Update CDSP firmware for QCM6490 platform
  - linux-firmware: add firmware for Lontium LT8713SX DP hub
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.2 build
  - qcom: update ADSP, CDSP firmware for sm8750  platform
  - qcom: update ADSP dtb.mbn for glymur platform
  - qca: Update Bluetooth WCN6750 1.1.3-00105 firmware to 1.1.3-00106
  -  QCA: Update Bluetooth WCN6856 firmware 2.1.0-00659 to 2.1.0-00665
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update SDMA 6.1.3 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update SDMA 6.1.2 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update SDMA 6.0.1 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update SDMA 6.1.1 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update SMU 14.0.3 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update VPE 6.1.0 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update SDMA 6.1.0 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update SDMA 6.0.2 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i
  - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i
  - linux-firmware:Renaming the file back for HP EliteBook X Flip G1i
  - amdnpu: Restore old NPU firmware for compatibility
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
  - lenovo: remove obsolete ish_lnlm_53c4ffad_2a17559f.bin firmware
  - linux-firmware: update firmware for MT7902 BT device
  - linux-firmware: update firmware for MT7902 WiFi device
  - qcom: vpu: fix SC7280 VPU Gen2 firmware and add compatibility symlink
  - amdgpu: DMCUB updates for various ASICs
  - qcom: Update DSP firmware for qcs8300 platform
  - cirrus: cs35l41: Add Firmware for ASUS Zenbook Laptop using CS35L41 HDA
  - qcom: Update DSP firmware for sa8775p platform
  - amdgpu: DMCUB updates for various ASICs
  - rtw89: 8851b: add format-1 for fw v0.29.41.5 with fw elements
  - rtw89: 8852a: add format-1 for fw v0.13.36.2 with fw elements
  - rtw89: 8852bt: add regd and diag_mac and update txpwr to R09
  - rtw89: 8852b: update txpwr element to R43
  - rtw89: 8852b: add format-2 with v0.29.29.15 and fw elements
  - Revert "rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2"
  - xe: Update GUC to v70.58.0 for LNL, BMG, PTL
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: QCA6390 hw2.0: update board-2.bin
  - qcom: Add gpu firmwares for Glymur chipset
  - amdgpu: DMCUB updates for various ASICs
  - qcom: vpu: add video firmware for Glymur
  - qcom: add QUPv3 firmware for x1e80100 platform
  - Bluetooth: Add symbolic links for Intel Solar JfP2/1 firmware variants
  - Bluetooth: Add symbolic links for Intel Solar firmware variants
  - Bluetooth: Add symbolic links for Intel Pulsar firmware variants
  - Bluetooth: Add symbolic links for Intel AX201 firmware variants
  - ath10k: WCN3990 hw1.0: update board-2.bin
  - qcom: add ADSP, CDSP firmware for glymur platform
  - ASoC: tas2783: Add Firmware files for tas2783A
  - linux-firmware: Update firmware file for Intel Solar core
  - mediatek MT7921: update bluetooth firmware to 20251223091725
  - rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673
  - ath12k: WCN7850 hw2.0: update board-2.bin
  - ath12k: QCN9274 hw2.0: update to WLAN.WBE.1.6-01243-QCAHKSWPL_SILICONZ-1
  - ath11k: WCN6855 hw2.0: update board-2.bin
  - ath11k: QCA6698AQ hw2.1: update board-2.bin
  - WHENCE: Correct 2 trailing whitespaces
  - linux-firmware: Add firmware for airoha-npu-7581 driver used for MT7990 offloading
  - linux-firmware: Add Dell ISH firmware for Intel panther lake systems
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: update Aeonsemi AS21x1x firmware to 1.9.1
  - rtl_nic: add firmware rtl8125cp-1 for RTL8125cp
  - ice: update DDP LAG package to 1.3.2.0
  - cirrus: cs35l56: Add WHENCE links for 17aa233c spkid0 firmware
  - rtw89: 8922a: update REGD R73-R08, txpwr R46 and element of diag MAC
  - rtw89: 8852c: update REGD R73-R60, txpwr R82 and element of diag MAC
  - Update firmware for NPU PHX, STX and STX HALO
  - qcom: Update ADSP and add CDSP firmware for qcs6490-radxa-dragon-q6a
  - qcom: Remove ADSP SensorPD json for Radxa Dragon Q6A
  - amdgpu: DMCUB updates for various ASICs
  Resolves: RHEL-154360


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260411-155.5
changelog:
  - Update linux-firmware to latest upstream (RHEL-164390)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - amdgpu: Revert Yellow Carp DMUB fw to 0x4000045
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.3 build
  - qcom: consolidate audioreach-tplg firmwares into one location in WHENCE
  - WHENCE: Fix ISH firmware symlink prefix for Lenovo PTL systems
  - intel_vpu: Update NPU firmware
  - Revert "rtl_bt: Update RTL8822C BT USB and UART firmware to 0x0673"
  - nvidia: add acr/bl symlink for booting GSP-RM on GA100
  - qcom: add QUPv3 firmware for shikra
  - xe: Update GUC to v70.60.0 for LNL, BMG, PTL
  - qcom: update ADSP firmware for sm8750 platform
  - qcom: update CDSP firmware for glymur platform
  - cirrus: cs35l41: Add support for new HP laptops
  - cirrus: cs35l41: Add support for new ASUS laptops
  - cirrus: cs35l41: Add support for ASUS GZ302EAC and add 15.5dB bincfg
  - WHENCE: Move Dell remoteproc firmware to correct section
  - qcom: vpu: add video firmware for SM8450
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some ASUS laptops
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops
  - iwlwifi: add Bz/Sc FW for core103-40 release
  - iwlwifi: Add Hr/Gf firmware for core103-40 release
  - iwlwifi: update ty/So/Ma firmwares for core103-40 release
  - amdgpu: DMCUB updates for various ASICs
  - xe: Update PTL GSC to v105.0.2.1397
  - linux-firmware: add firmware for Moxa mux50u devices
  - rtl_bt: Update RTL8852B BT USB FW to 0x127C_FD78
  - ath11k: WCN6855 hw2.0@nfa765: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866.5-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - linux-firmware: update firmware for qat_4xxx devices
  - linux-firmware: update firmware for qat_402xx devices
  - linux-firmware: update firmware for qat_420xx devices
  - linux-firmware: update firmware for an8811hb 2.5G ethernet phy
  - linux-firmware: qcom: Add FW blobs for DELL XPS13 9345
  - amdgpu: DMCUB updates for various ASICs
  - cirrus: cs35l63: Update firmware for Cirrus Amps for some Dell laptops
  - cirrus: cs35l63: Fix Cirrus Amp firmware links for some Dell laptops
  - linux-firmware: Add firmware file for Intel BlazarIW
  - linux-firmware: Add firmware file for Intel BlazarIGfp2 core
  - iwlwifi: add Bz/Wh FW for core102-56 release
  - ath12k: WCN7850 hw2.0: update to WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3
  - mediatek MT7921: update bluetooth firmware to 20260224111243
  - mediatek MT7920: update bluetooth firmware to 20260224111231
  - Add LENOVO ISH firmware v5.8.1.7720 for X1 Carbon (Gen 14) and X1 2-in-1 (Gen 11)
  - linux-firmware: Add ISH firmware file for Intel Wildcat Lake platform
  - linux-firmware: update firmware for MT7920 WiFi device
  - linux-firmware: update firmware for MT7921 WiFi device
  - linux-firmware: Update firmware file for Intel Quasar core
  - Intel Bluetooth: Update firmware file for Intel Bluetooth AX201
  - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - intel_vpu: Update NPU firmware
  Resolves: RHEL-164390


author: Denys Vlasenko <dvlasenk@redhat.com> - 20251111-156
changelog:
  - Update linux-firmware to latest upstream (RHEL-128087)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - rtl_bt: Update RTL8922A BT USB firmware to 0x41C0_C905
  - linux-firmware: add firmware for mt7987 internal 2.5G ethernet phy
  - rtw88: 8822b: Update firmware to v30.20.0
  - rtl_nic: add firmware rtl8125k-1
  - ASoC: tas2781: Update dsp firmware for HP and ASUS projects
  - ASoC: tas2781: Update dsp firmware for HP and ASUS projects
  - amdgpu: DMCUB updates for various ASICs
  - amdgpu: DMCUB updates for various ASICs
  - qcom: add SOCCP firmware for kaanapali platform
  - xe: Update GUC to v70.53.0 for BMG, LNL, PTL
  - i915: Update GUC to v70.53.0 for DG2, MTL
  - rtw89: 8851b: update fw to v0.29.41.5
  - rtw89: 8852b: update fw to v0.29.128.0 with format suffix -2
  - rtw89: 8852b: update fw to v0.29.29.14
  - Revert "rtw89: 8852b: update fw to v0.29.128.0"
  - rtw89: 8852bt: update fw to v0.29.127.0 with format suffix -1
  - rtw89: 8852bt: update fw to v0.29.122.1
  - Revert "rtw89: 8852bt: update fw to v0.29.127.0"
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Create audio folder in ti folder, and move all the audio firmwares into it
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Update WHENCE for microcode_amd_fam19h.bin
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20251015213201
  - rtl_bt: Add firmware and config files for RTL8761CUV
  - linux-firmware: Update AMD cpu microcode
  - qcom: add ADSP firmware for kaanapali platform
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Renaming the file to cover a wide range of HP Lunar Lake system.
  - mediatek MT7920: update bluetooth firmware to 20251020151255
  - linux-firmware: update firmware for MT7922 WiFi device
  - linux-firmware: update firmware for MT7920 WiFi device
  - amd-ucode: Fix minimum revisions in README
  - cirrus: cs35l41: Rename various Asus Laptop firmware files to not have Speaker ID
  - mediatek MT7922: update bluetooth firmware to 20251020143443
  - Revert "linux-firmware: update firmware for MT7922 WiFi device"
  - QCA: Update Bluetooth WCN6856 firmware 2.1.0-00653 to 2.1.0-00659
  - iwlwifi: add Bz/Fm and gl FW for core98-161 release
  - iwlwifi: update Bz/Hr and Bz/Gf firmwares for core98-161 release
  - iwlwifi: update ty/So/Ma firmwares for core98-161 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core98-161 release
  - intel: qat: Fix missing link
  - amdgpu: DMCUB updates for various ASICs
  - nvidia: add generic bootloader for GSP-enabled systems
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.0 build
  - qcom: vpu: rename firmware binaries
  - Intel IPU7: Update product signed firmware binary
  - i915: Xe2LPD DMC v2.29
  - i915: Xe3LPD DMC v2.32
  - i915: Xe3LPD_3002 DMC v2.27
  - WHENCE: nvidia: rearrange GSP-RM firmware lines
  - linux-firmware: Add ISH firmware file for Intel Pather Lake platform
  - linux-firmware: Update firmware file for Intel Magnetar core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - qcom: add CDSP firmware for kaanapali platform
  - qcom: add version for A650 GMU firmware
  - qca: Update Bluetooth WCN6750 1.1.3-00091 firmware to 1.1.3-00100
  - qcom: Add firmwares for Kaanapali GPU
  - qcom: Update A623 GMU fw
  - qcom: Fix QCS615 chipset's GPU secure fw
  - qcom: Update DSP firmware for sa8775p platform
  - amdgpu: DMCUB updates for various ASICs
  - WHENCE: remove link for Kaanapali video firmware
  - intel_vpu: Update NPU firmware
  - linux-firmware: Add Dell ISH firmware for Intel Lunar Lake systems
  - Update VCN for Navi1x, Green Sardine and Renoir
  - WHENCE: extract multitech license text
  - WHENCE: extract ueagle license
  - WHENCE: use LICENCE.sensoray for s2255drv
  - WHENCE: rename LICENCE.go7007-s2250 to LICENCE.sensoray
  - WHENCE: clean up emi62 and yam license statements
  - qcom: vpu: update video firmware binary for SM8550
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x3BAC_ADBA
  - qcom: vpu: add video firmware for Kaanapali
  - qcom: Update DSP firmware for qcs8300 platform.
  - qcom: Add Audio topology for HAMOA-EVK
  - intel/ish:Add ISH firmware file for Intel Lunar Lake platform
  - mediatek: update firmware version info for MT7986/81/16
  - linux-firmware: ql2500_fw: update ISP25xx Firmware
  - qcom: Update aic100 firmware files
  - qcom: Add audio topology and ADSP firmware for qcs6490-radxa-dragon-q6a
  - amdgpu: DMCUB updates for various ASICs
  - mediatek: mtk_wed: drop links for mt7988
  - Revert "amdgpu: update gc 10.3.6 firmware"
  - qcom: Update DSP firmware for qcs8300 platform.
  - powervr: update firmware for Imagination Technologies BXS-4-64 GPU
  - qcom: Update DSP firmware for sa8775p platform.
  - amdgpu: DMCUB updates for various ASICs
  - ath12k: WCN7850 hw2.0: update board-2.bin
  - qcom: move LEMANS EVK firmware to correct location
  - amdgpu: update PSP 14.0.3 kicker firmware
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update VPE 6.1.0 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update renoir firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update SMU 13.0.0 kicker firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SDMA 6.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update SDMA 6.1.3 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update VPE 6.1.3 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - linux-firmware: update firmware for en8811h 2.5G ethernet phy
  - amdgpu: DMCUB updates for various ASICs
  - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10
  - mediatek MT7922: update bluetooth firmware to 20250903123504
  - linux-firmware: update firmware for MT7922 WiFi device
  - qcom: move Monaco EVK topology from qcs8275 to qcs8300 subdir
  - qcom: Add Audio topology for MONACO-EVK
  - qcom: add CDSP firmware for qcs615 platform
  - qcom: Add Audio topology for LEMANS-EVK
  - ath12k: WCN7850 hw2.0@ncm865: add to WLAN.IOE_HMT.1.1-00018-QCAHMTSWPL_V1.0_V2.0_SILICONZ-1
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925:update bluetooth firmware to 20250825220109 Update binary firmware for MT7925 BT devices.
  - qcom: vpu: update firmware binaries to fix encoder drain handling
  - intel_vpu: Update NPU firmware
  - Revert "cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers"
  - cs35l56: Rename firmware for Thinkbook 16P Gen6 (17AA3921) without multiple speakers
  - xe: Update GUC to v70.49.4 for BMG, LNL, PTL
  - i915: Update GUC to v70.49.4 for ADL-P, DG1, DG2, MTL, TGL
  - qcom: add ADSP firmware for qcs615 platform
  - rtl_bt: Update RTL8822C BT USB firmware to 0x2B66_D962
  - iwlwifi: add Bz-HR FW for core90-93 release
  - Fix link entry for qat_895xcc.bin
  - Move QAT firmware to intel/ subdirectory
  - Move all iwlwifi top level files to intel/ directory
  - Revert "intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10"
  - ath11k: Support WCN6855 hw2.1 with NFA firmware variant
  - amdgpu: Update ISP FW for isp v4.1.1
  - Update README.md to clarify S-o-b requirements
  - firmware: qcom: Reorder VPU firmware entries in WHENCE
  - intel_vpu: Update NPU firmware
  - amdgpu: DMCUB updates for various ASICs
  - intel/ish: Add firmware for LENOVO THINKPAD X1 2-in-1 Gen 10
  - cirrus: cs35l41: Move entries to correct driver section in WHENCE
  - cirrus: cs35l56: Update firmware for Cirrus Amps for some Lenovo laptops
  - ath11k: WCN6855 hw2.0@nfa765: add to WLAN.HSP.1.1-04685-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - cirrus: cs35l56: Add firmware for Cirrus Amps for some Lenovo laptops
  - qcom: Add firmware binary for SM8650.
  - Link rtl8723b_config.bin to rtl8723bs
  - rtw89: 8922a: update fw to v0.35.80.3
  - rtw89: 8852c: update fw to v0.27.129.4
  - rtw89: 8852c: update fw to v0.27.129.3
  - qcom: add CDSP firmware for x1e80100 platform
  - iwlwifi: add Bz/gl FW for core97-84 release
  - iwlwifi: update ty/So/Ma firmwares for core97-84 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core97-84 release
  - amdgpu: DMCUB updates for various ASICs
  - realtek: rt1321: Add patch firmware of MCU
  - mediatek: Add MT8189 SCP firmware
  Resolves: RHEL-128087


author: Denys Vlasenko <dvlasenk@redhat.com> - 20251111-158
changelog:
  - Fix placement of several iwlwifi files in iwl*-firmware
  - Correct changelog dates
  Resolves: RHEL-128087


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260107-159
changelog:
  - Update linux-firmware to latest upstream (RHEL-139962)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - qcom: Update aic100 firmware files
  - qca: Update Bluetooth WCN6750 1.1.3-00100 firmware to 1.1.3-00105
  - firmware: Revert kernel_boot.elf due to license compliance issue
  - linux-firmware: add firmware for an8811hb 2.5G ethernet phy
  - i915: Xe3LPD_3002 DMC v2.28
  - i915: Xe3LPD DMC v2.33
  - intel_vpu: Add firmware for 50xx NPUs and update older ones
  - linux-firmware: Update AMD SEV firmware
  - amdgpu: DMCUB updates for various ASICs
  - qcom: venus-5.4: fix ELF segment alignment to 4 bytes
  - mediatek MT7925: update bluetooth firmware to 20251210093205
  - linux-firmware: update firmware for MT7925 WiFi device
  - rcar_gen4_pcie: add firmware for Renesas R-Car Gen4 PCIe controller
  - qcom: Update CDSP firmware for qcm6490 platform
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x488C_DB55
  - linux-firmware: Add firmware file for Intel Scorpius core
  - rtw89: 8852b: update fw to v0.29.29.15
  - cirrus: cs35l41: Update firmware and tuning for various HP laptops
  - cirrus: cs35l41: Add support for new HP Clipper laptop
  - qcom: drop compatibility a640_zap.mdt symlink
  - qcom: add version for a530v3_gpmu.fw2
  - xe: Update GUC to v70.55.3 for BMG, PTL
  - iwlwifi: add Bz/Sc FW for core101-82 release
  - iwlwifi: Add Sc/Gf firmware for core101-82 release
  - iwlwifi: update ty/So/Ma firmwares for core101-82 release
  - iwlwifi: update cc/Qu/QuZ firmwares for core101-82 release
  - amdgpu: DMCUB updates for various ASICs
  - qcom: Add firmwares for sm8150 GPU
  - qcom: Add firmwares for sm8450 GPU
  - qcom: Add firmwares for sm8550 GPU
  - qcom: Add firmwares for sm8650 GPU
  - qcom: Add firmwares for sm8750 GPU
  - Makefile: add licence header
  - ath10k: WCN3990 hw1.0: update board-2.bin
  - ath10k: QCA9888 hw2.0: update board-2.bin
  - ath10k: QCA4019 hw1.0: update board-2.bin
  - cirrus: cs35l41: Add support for new HP laptops
  - Revert "amdgpu: update GC 11.5.0 firmware"
  - linux-firmware: Update amd-ucode copyright information
  - linux-firmware: Update AMD cpu microcode
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - ath11k: QCA6698AQ hw2.1: update to WLAN.HSP.1.1-04866-QCAHSPSWPL_V1_V2_SILICONZ_IOE-1
  - ath11k: QCA2066 hw2.1: update board-2.bin
  - qcom: update ADSP firmware for x1e80100 platform, change the license
  - qcom: reorder ADSP, CDSP firmware entries for qcs8300 in WHENCE
  - Reapply "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update SMU 14.0.3 firmware"
  - Revert "amdgpu: update GC 10.3.6 firmware"
  - Revert "amdgpu: update GC 11.5.1 firmware"
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20251124093155
  - intel_vpu: Update NPU firmware
  - WHENCE: fix version string for video firmware
  - qcom: vpu: update video firmware binary for SM8250
  - xe: Update GUC to v70.54.0 for BMG, PTL
  - Revert "amdgpu: update GC 11.0.1 firmware"
  - QCA: Add Bluetooth firmware for WCN685x uart interface
  - qcom: Add ADSP firmware for qcs6490-thundercomm-rubikpi3
  - qcom: venus-5.4: update firmware binary for v5.4
  - qcom: venus-5.4: remove unused firmware file
  - iwlwifi: add Sc/Wh FW for core98-181 release
  - amdgpu: DMCUB updates for various ASICs
  - rtl_bt: Update RTL8852B BT USB FW to 0x42D3_4E04
  - ASoC: tas2781: Add more symbol links on SPI devices
  - amdgpu: update vega20 firmware
  - amdgpu: update vega12 firmware
  - amdgpu: update vega10 firmware
  - amdgpu: update vangogh firmware
  - amdgpu: update renoir firmware
  - amdgpu: update yellow carp firmware
  - amdgpu: update VCN 3.1.2 firmware
  - amdgpu: update PSP 13.0.5 firmware
  - amdgpu: update GC 10.3.6 firmware
  - amdgpu: update VCN 5.0.0 firmware
  - amdgpu: update SMU 14.0.3 firmware
  - amdgpu: update PSP 14.0.3 firmware
  - amdgpu: update GC 12.0.1 firmware
  - amdgpu: update SMU 14.0.2 firmware
  - amdgpu: update PSP 14.0.2 firmware
  - amdgpu: update GC 12.0.0 firmware
  - amdgpu: update VCN 4.0.4 firmware
  - amdgpu: update smu 13.0.7 firmware
  - amdgpu: update PSP 13.0.7 firmware
  - amdgpu: update GC 11.0.2 firmware
  - amdgpu: update SMU 13.0.10 firmware
  - amdgpu: update SDMA 6.0.3 firmware
  - amdgpu: update PSP 13.0.10 firmware
  - amdgpu: update GC 11.0.3 firmware
  - amdgpu: update smu 13.0.0 kicker firmware
  - amdgpu: update PSP 13.0.0 kicker firmware
  - amdgpu: update VCN 4.0.0 firmware
  - amdgpu: update SMU 13.0.0 firmware
  - amdgpu: update PSP 13.0.0 firmware
  - amdgpu: update GC 11.0.0 firmware
  - amdgpu: update navy flounder firmware
  - amdgpu: update sienna cichlid firmware
  - amdgpu: update navi14 firmware
  - amdgpu: update navi12 firmware
  - amdgpu: update navi10 firmware
  - amdgpu: update VCN 5.0.1 firmware
  - amdgpu: update PSP 13.0.12 firmware
  - amdgpu: update GC 9.5.0 firmware
  - amdgpu: update PSP 13.0.14 firmware
  - amdgpu: update GC 9.4.4 firmware
  - amdgpu: update PSP 14.0.5 firmware
  - amdgpu: update GC 11.5.3 firmware
  - amdgpu: update PSP 14.0.4 firmware
  - amdgpu: update GC 11.5.2 firmware
  - amdgpu: update green sardine firmware
  - amdgpu: update VCN 4.0.3 firmware
  - amdgpu: update SDMA 4.4.2 firmware
  - amdgpu: update PSP 13.0.6 firmware
  - amdgpu: update GC 9.4.3 firmware
  - amdgpu: update VCN 4.0.6 firmware
  - amdgpu: update PSP 14.0.1 firmware
  - amdgpu: update GC 11.5.1 firmware
  - amdgpu: update PSP 13.0.11 firmware
  - amdgpu: update GC 11.0.4 firmware
  - amdgpu: update VCN 4.0.5 firmware
  - amdgpu: update PSP 14.0.0 firmware
  - amdgpu: update GC 11.5.0 firmware
  - amdgpu: update VCN 4.0.2 firmware
  - amdgpu: update PSP 13.0.4 firmware
  - amdgpu: update GC 11.0.1 firmware
  - amdgpu: update beige goby firmware
  - amdgpu: update dimgrey cavefish firmware
  - amdgpu: update aldebaran firmware
  - amdgpu: add vce1 firmware
  - mediatek MT7922: update bluetooth firmware to 20251118163447
  - linux-firmware: update firmware for MT7922 WiFi device
  - qcom: update ADSP, CDSP firmware for kaanapali platform, change the license
  - qcom: add ADSP, CDSP firmware for sm8750 platform
  - rtl_nic: add firmware rtl9151a-1
  - qcom: Update aic100 firmware files
  - mt76: add firmware for MT7990
  - mt76: update firmware for MT7992
  - mt76: update firmware for MT7996
  - cirrus: cs35l57: Add firmware for a few Dell products
  - cirrus: cs42l45: Add firmware for Cirrus Logic CS42L45 SDCA codec
  - qcom: Add sdx35 Foxconn vendor firmware image file
  - linux-firmware: Update AMD cpu microcode
  Resolves: RHEL-139962


author: Denys Vlasenko <dvlasenk@redhat.com> - 20260130-160
changelog:
  - Update linux-firmware to latest upstream (RHEL-145341)
    Changes since the last update are noted on items below, copied from
    the git changelog of upstream linux-firmware repository.
  - intel/ish: Add Lenovo ISH firmware support for X1 and X9 systems
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Lenovo laptops
  - cirrus: cs42l45: Add CS42L45 SDCA codec firmware for Dell laptops
  - cirrus: cs35l57 cs35l63: Add firmware for Cirrus Amps for some Lenovo laptops
  - cirrus: cs35l56 cs35l57: Add and update firmware for some Dell laptops
  - Intel IPU7: Update firmware binary for Panther Lake
  - linux-firmware: update firmware for MT7921 WiFi device
  - amdgpu: DMCUB updates for various ASICs
  - linux-firmware: Add firmware file for Intel ScorpiusGfp2 core
  - linux-firmware: Update firmware file for Intel Scorpius core
  - linux-firmware: Update firmware file for Intel BlazarIGfP core
  - linux-firmware: Update firmware file for Intel BlazarI core
  - linux-firmware: Update firmware file for Intel BlazarU-HrPGfP core
  - linux-firmware: Update firmware file for Intel BlazarU core
  - rtl_bt: Update RTL8852BT/RTL8852BE-VT BT USB FW to 0x06EB_C65F
  - linux-firmware: Add firmware for airoha-npu-7583 driver
  - iwlwifi: add Bz/Sc FW for core102-56 release
  - iwlwifi: Add Hr/Gf firmware for core102-56 release
  - iwlwifi: update ty/So/Ma firmwares for core102-56 release
  - xe: Add GSC 105.0.2.1301 for PTL
  - mediatek: rename MT8188 SCP firmware
  - qcom: Update DSP firmware for QCM6490 platform
  - linux-firmware: qcom: sync audioreach firmwares from v1.0.1 build
  - linux-firmware: update firmware for MT7925 WiFi device
  - mediatek MT7925: update bluetooth firmware to 20260106153314
  - mediatek MT7920: update bluetooth firmware to 20260105151350
  - mediatek MT7922: update bluetooth firmware to 20260106153735
  - linux-firmware: update firmware for MT7922 WiFi device
  - Mellanox: Add new mlxsw_spectrum firmware xx.2016.3900
  - amdgpu: Update dcn314, dcn315 firmware to 0.1.42.0
  - qcom: Update DSP firmware for sa8775 platform
  - QCA: Add Bluetooth firmware for QCC2072 uart interface
  - i915: Xe3p_LPD DMC v2.33
  - qcom: Update DSP firmware for qcs8300 platform
  - linux-firmware: update firmware for MT7920 WiFi device
  Resolves: RHEL-145341


author: Tomas Halman <thalman@redhat.com> - 1.6-19.0.2
changelog:
  - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
  - Resolves: RHEL-168184


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.40.1.el9_7]
changelog:
  - s390/pci: Allow automatic recovery with minimal driver support (CKI Backport Bot) [RHEL-118881]
  - mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported (Luiz Capitulino) [RHEL-143846]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.41.1.el9_7]
changelog:
  - net: vxlan: prevent NULL deref in vxlan_xmit_one (Antoine Tenart) [RHEL-133369]
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Mark Langsdorf) [RHEL-123057]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.42.1.el9_7]
changelog:
  - scsi: qla2xxx: Allow recovery for tape devices (Ewan D. Milne) [RHEL-153437]
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-142600]
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton R. Krzesinski) [RHEL-128734]
  - kbuild: use $(srctree)/$(src) for some Makefiles to fix the buildcheck test (Herton R. Krzesinski) [RHEL-106032]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.43.1.el9_7]
changelog:
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150422] {CVE-2026-23193}
  - ALSA: aloop: Fix racy access at PCM trigger (CKI Backport Bot) [RHEL-150130] {CVE-2026-23191}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146421] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146421] {CVE-2025-38323}
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125460] {CVE-2025-40096}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.44.1.el9_7]
changelog:
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152551]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154395]
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154395]
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
  - smb/client: fix memory leak in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-154395]
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152383] {CVE-2026-23171}
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CKI Backport Bot) [RHEL-150477] {CVE-2026-23144}
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150226]
  - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150226] {CVE-2026-23209}
  - dpll: zl3073x: Fix output pin phase adjustment sign (CKI Backport Bot) [RHEL-149764]
  - scsi: s390: zfcp: Ensure synchronous unit_add (CKI Backport Bot) [RHEL-143736]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.45.1.el9_7]
changelog:
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150403] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150403]
  - iommu: Skip PASID validation for devices without PASID capability (Eder Zulian) [RHEL-95264]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.46.1.el9_7]
changelog:
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154094]
  - net: mana: Reduce waiting time if HWC not responding (Maxim Levitsky) [RHEL-92243]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.47.1.el9_7]
changelog:
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.48.1.el9_7]
changelog:
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
  - iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
  - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.49.1.el9_7]
changelog:
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.35.1.el9_7]
changelog:
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Paolo Abeni) [RHEL-137841] {CVE-2025-38129}
  - exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146403] {CVE-2025-38206}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.36.1.el9_7]
changelog:
  - net/smc: Remove validation of reserved bits in CLC Decline message (Mete Durlu) [RHEL-143718]
  - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-149495]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147266] {CVE-2026-23097}
  - ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148166]
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Xin Long) [RHEL-144987]
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Xin Long) [RHEL-144987]
  - gue: Fix skb memleak with inner IP protocol 0. (Xin Long) [RHEL-144987]
  - netlink: specs: fou: replace underscores with dashes in names (Xin Long) [RHEL-144987]
  - fou: fix initialization of grc (Xin Long) [RHEL-144987]
  - fou: Fix null-ptr-deref in GRO. (Xin Long) [RHEL-144987]
  - fou: remove warn in gue_gro_receive on unsupported protocol (Xin Long) [RHEL-144987]
  - fou: Remove XRFM from NET_FOU Kconfig (Xin Long) [RHEL-144987]
  - fou: remove sparse errors (Xin Long) [RHEL-144987]
  - redhat: enable FOU modules in kernel-modules-extra (Xin Long) [RHEL-144987]
  - s390/mm: Fix __ptep_rdp() inline assembly (Mete Durlu) [RHEL-143713]
  - dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146357]
  - dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-147459]
  - i40e: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - ice: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-146049]
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143545] {CVE-2025-71085}
  - tick/sched: Limit non-timekeeper CPUs calling jiffies update (Phil Auld) [RHEL-141462]
  - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130017] {CVE-2025-40168}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.37.1.el9_7]
changelog:
  - printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148302]
  - printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148302]
  - printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148302]
  - printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148302]
  - printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148302]
  - printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148302]
  - printk: nbcon: Use raw_cpu_ptr() instead of open coding (CKI Backport Bot) [RHEL-148302]
  - backport "printk: Add helper for flush type logic" and associated changes (CKI Backport Bot) [RHEL-148302]
  - printk: Remove redundant deferred check in vprintk() (CKI Backport Bot) [RHEL-148302]
  - printk: Introduce force_legacy_kthread() macro (CKI Backport Bot) [RHEL-148302]
  - printk: Add is_printk_legacy_deferred() (CKI Backport Bot) [RHEL-148302]
  - io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137988]
  - io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137988]
  - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137988] {CVE-2025-38106}
  - io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137988]
  - io_uring/sqpoll: annotate debug task == current with data_race() (Jeff Moyer) [RHEL-137988]
  - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144125] {CVE-2026-23001}
  - net/smc: Fix lookup of netdev by using ib_device_get_netdev() (CKI Backport Bot) [RHEL-114786]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.38.1.el9_7]
changelog:
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143194] {CVE-2025-68800}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.39.1.el9_7]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot) [RHEL-142232] {CVE-2025-39818}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.50.1.el9_7]
changelog:
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
  - md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.51.1.el9_7]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.53.1.el9_7]
changelog:
  - tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.54.1.el9_7]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.55.1.el9_7]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174561] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-683.el9]
changelog:
  - perf amd ibs: Sync arch/x86/include/asm/amd-ibs.h header with the kernel (Michael Petlan) [RHEL-106898]
  - perf test amd ibs: Add sample period unit test (Michael Petlan) [RHEL-106898]
  - perf mem/c2c amd: Add ldlat support (Michael Petlan) [RHEL-106898]
  - perf test: Simplify data symbol test (Michael Petlan) [RHEL-106898]
  - perf test: Add timeout to datasym workload (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Incorporate Zen5 DTLB and PageSize information (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Add Load Latency bits in raw dump (Michael Petlan) [RHEL-106898]
  - ice: dpll: fix rclk pin state get and misplaced header macros (Ivan Vecera) [RHEL-146370]
  - ice: dpll: Support E825-C SyncE and dynamic pin discovery (Ivan Vecera) [RHEL-146370]
  - drivers: Add support for DPLL reference count tracking (Ivan Vecera) [RHEL-146370]
  - redhat: configs: Enable CONFIG_DPLL_REFCNT_TRACKER for debug (Ivan Vecera) [RHEL-146370]
  - dpll: Add reference count tracking support (Ivan Vecera) [RHEL-146370]
  - dpll: Enhance and consolidate reference counting logic (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Add support for mux pin type (Ivan Vecera) [RHEL-146370]
  - dpll: Support dynamic pin index allocation (Ivan Vecera) [RHEL-146370]
  - dpll: Add notifier chain for dpll events (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Associate pin with fwnode handle (Ivan Vecera) [RHEL-146370]
  - dpll: Allow associating dpll pin with a firmware node (Ivan Vecera) [RHEL-146370]
  - perf/x86/amd/uncore: Avoid a false positive warning about snprintf truncation in amd_uncore_umc_ctx_init (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Prevent UMC counters from saturating (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Add parameter to configure hrtimer (Michael Petlan) [RHEL-106948]
  - perf/x86/intel/uncore: Use HRTIMER_MODE_HARD for detecting overflows (Michael Petlan) [RHEL-106948]
  - perf/x86: Switch to use hrtimer_setup() (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Use hrtimer for handling overflows (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Michael Petlan) [RHEL-106948]
  - pinctrl: intel: fix build warnings about export.h (David Arcari) [RHEL-130326]
  - pinctrl: intel: drop repeated config dependency (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Import PWM_LPSS namespace for devm_pwm_lpss_probe() (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: Use dedicated helpers for chained IRQ handlers (David Arcari) [RHEL-130326]
  - pinctrl: elkhartlake: Add support for DSW community (David Arcari) [RHEL-130326]
  - pinctrl: intel: Add a human readable decoder for pull bias values (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: Add Panther Lake to the list of supported (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: use semicolon instead of comma in ncommunities assignment (David Arcari) [RHEL-130326]
  - pinctrl: amd: Clear GPIO debounce for suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Constify pointers to 'pinctrl_desc' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix hibernation support with CONFIG_SUSPEND unset (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix use of undeclared identifier 'pinctrl_amd_s2idle_dev_ops' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Add an LPS0 check() callback (David Arcari) [RHEL-130338]
  - pinctrl: Use str_enable_disable-like helpers [partial] (David Arcari) [RHEL-130338]
  - pinctrl: amd: Take suspend type into consideration which pins are non-wake (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix two small typos (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Convert to platform remove callback returning void (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask wake bits on probe again (David Arcari) [RHEL-130338]
  - idpf: Fix data race in idpf_net_dim (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: read lower clock bits inside the time sandwich (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: ixgbe: migrate to new RXFH callbacks (Michal Schmidt) [RHEL-139535]
  - idpf: Fix error handling in idpf_vport_open() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL ptr issue after soft reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT configuration on down interfaces (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix issue with ethtool -n command display (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak of flow steer list on rmmod (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: detach and close netdevs while handling a reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use desc_ring when checking completion queue DMA allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: convert vport state to bitmap (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vc_core_deinit() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix LAN memory regions command on some NVMs (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix irdma_alloc_ucontext_resp padding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix SRQ shadow area address initialization (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove doorbell elision logic (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add missing mutex destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SIGBUS in AEQ destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove unused CQ registry (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Take a lock before moving SRQ tail in poll_cq (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: depend on DEBUG_FS when building LIBIE_FWLOG (Michal Schmidt) [RHEL-122275 RHEL-139535]
  - RDMA/irdma: CQ size and shadow update changes for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix vf_id size to u16 to avoid overflow (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add Atomic Operations support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add SRQ support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Support 64-byte CQEs and GEN3 CQE opcode decoding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add support for V2 HMC resource management scheme (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend QP context programming for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 virtual QP1 support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Introduce GEN3 vPort driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 HW statistics support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 support for AEQ and CEQ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 CQP support with deferred completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Discover and set up GEN3 hardware register layout (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 core driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Refactor GEN2 auxiliary driver (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fwlog support for e610 (Michal Schmidt) [RHEL-139535]
  - i40e: fix Jumbo Frame support after iPXE boot (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie_aq_str (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie adminq descriptors (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ixgbe: use libie adminq descriptors (Michal Schmidt) [RHEL-139535]
  - idpf: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement get LAN MMIO memory regions (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - resource: Add resource set range and size helpers (Michal Schmidt) [RHEL-139535]
  - i40e: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ice, irdma: fix an off by one in error handling code (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ice: use napi's irq affinity and rmap IRQ notifiers (Michal Schmidt) [RHEL-139535]
  - net: intel: implement modern PM ops declarations [e100,e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - net: adopt skb_network_offset() and similar helpers [i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix aux device unplugging when rdma is not supported by vport (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: cap maximum Rx buffer size (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix error handling in the init_task on load (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vport_rel() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: keep the netdev when a reset fails (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: fix OOB in e1000_tbi_should_accept() (Michal Schmidt) [RHEL-139535] {CVE-2025-71093}
  - idpf: reduce mbx_task schedule delay to 300us (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [RHEL-139535 RHEL-97658] {CVE-2025-71133}
  - i40e: validate ring_len parameter against hardware-specific values (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: fix scheduling in set_rx_mode (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: correct queue index in Rx allocation error messages (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ixgbe: avoid redundant call to ixgbe_non_sfp_link_config() (Michal Schmidt) [RHEL-139535]
  - e1000e: Remove unneeded checks (Michal Schmidt) [RHEL-139535]
  - ixgbevf: ixgbevf_q_vector clean up (Michal Schmidt) [RHEL-139535]
  - fm10k: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ixgbevf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ice: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - iavf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - i40e: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_free_pble (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: delete a stray tab (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix possible vport_config NULL pointer deref in remove (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-68213}
  - net: ixgbe: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-139535]
  - RDMA/irdma: Remove redundant NULL check of udata in irdma_create_user_ah() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: support generic devlink param "max_mac_per_vf" (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for IDPF PCI programming interface (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Silently consume unsignaled completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Initialize cqp_cmds_info to prevent resource leaks (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Enforce local fence for LOCAL_INV WRs (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fix typos in ixgbe driver comments (Michal Schmidt) [RHEL-139535]
  - idpf: remove duplicate defines in IDPF_CAP_RSS (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: avoid redundant VF link state updates (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SD index calculation (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: cleanup remaining SKBs in PTP flows (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-40175}
  - idpf: fix mismatched free function for dma_alloc_coherent (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Remove unused struct irdma_cq fields (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - net: intel: fm10k: Fix parameter idx set but not used (Michal Schmidt) [RHEL-139535]
  - idpf: add HW timestamping statistics (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: improve VF MAC filters accounting (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Update Kconfig (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: fix linking with libie_{adminq,fwlog} when CONFIG_LIBIE=n (Michal Schmidt) [RHEL-139535]
  - i40e: remove redundant memory barrier when cleaning Tx descs (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for nointerrupt queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove SW marker handling from NAPI (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add 4-byte completion descriptor definition (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: link NAPIs to queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use a saner limit for default number of queues to allocate (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix Rx descriptor ready check barrier in splitq (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: drop unnecessary constant casts to u16 (Michal Schmidt) [RHEL-139535]
  - i40e: Fix potential invalid access when MAC list is empty (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39853}
  - i40e: remove read access to debugfs files (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39901}
  - idpf: fix UAF in RDMA core aux dev deinitialization (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: do not linearize big TSO packets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove obsolete stashing code (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: stop Tx if there are insufficient buffer resources (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: replace flow scheduling buffer ring with buffer pool (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: simplify and fix splitq Tx packet rollback error path (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: improve when to set RE bit logic (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add support for Tx refillqs in flow scheduling mode (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: intel: use vmalloc_array() to simplify code [fm10k] (Michal Schmidt) [RHEL-139535]
  - idpf: preserve coalescing settings across resets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add cross timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: rename enum virtchnl2_cap_rss (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ethernet: intel: fix building with large NR_CPUS [fm10k,i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: implement IDC vport aux driver MTU change handler (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement remaining IDC RDMA core callbacks and handlers (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement RDMA vport auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: implement core RDMA auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: use reserved RDMA vectors from control plane (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: return 0 size for RSS key if not supported (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-38402}
  - e1000: Move cancel_work_sync to avoid deadlock (Michal Schmidt) [RHEL-139535] {CVE-2025-38114}
  - i40e: retry VFLR handling if there is ongoing VF reset (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: return false from i40e_reset_vf if reset is in progress (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - iavf: convert to NAPI IRQ affinity API (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - ice: add ice driver PTP pin documentation (Michal Schmidt) [RHEL-139535]
  - i40e: add link_down_events statistic (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for Rx timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp flows (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp capabilities negotiation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add PTP clock configuration (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add mailbox access to read PTP clock time (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: negotiate PTP capabilities and get PTP clock (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: move virtchnl structures to the header file (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl: add PTP virtchnl definitions (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add initial PTP support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: change the method for mailbox workqueue allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove unreachable code from setting mailbox (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: assign extracted ptype to struct libeth_rqe_info field (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA: Don't use %pK through printk (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: use napi's irq affinity (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - intel/fm10k: Remove unused fm10k_iov_msg_mac_vlan_pf (Michal Schmidt) [RHEL-139535]
  - e1000: Hold RTNL when e1000_down can be called (Michal Schmidt) [RHEL-139535]
  - e1000: Link NAPI instances to queues and IRQs (Michal Schmidt) [RHEL-139535]
  - net: handle HAS_IOPORT dependencies [intel] (Michal Schmidt) [RHEL-139535]
  - intel: make module parameters readable in sys filesystem [e100] (Michal Schmidt) [RHEL-139535]
  - intel: add bit macro includes where needed [e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - ice: add documentation for FW logging (Michal Schmidt) [RHEL-139535]
  - i40e: Annotate struct i40e_qvlist_info with __counted_by (Michal Schmidt) [RHEL-139535]
  - fm10k: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e1000: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e100: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - net: e1000: Remove unused declarations (Michal Schmidt) [RHEL-139535]
  - Documentation/eth/intel: Remove references to SourceForge (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - Documentation/eth/intel: Update address for driver support (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - ixgb: Remove ixgb driver (Michal Schmidt) [RHEL-139535]
  - ice: Fix broken link in ice NAPI doc (Michal Schmidt) [RHEL-139535]
  - e100: Fix possible use after free in e100_xmit_prepare (Michal Schmidt) [RHEL-139535] {CVE-2022-49026}
  - fm10k: Fix error handling in fm10k_init_module() (Michal Schmidt) [RHEL-139535]
  - e1000: Remove unnecessary use of kmap_atomic() (Michal Schmidt) [RHEL-139535]
  - intel/fm10k:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - intel/e1000:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - fm10k: remove unexpected word "the" (Michal Schmidt) [RHEL-139535]
  - intel: remove unused macros [e100,e1000,ixgb] (Michal Schmidt) [RHEL-139535]
  - ixgb: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - e1000: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - i40e: remove enum i40e_client_state (Michal Schmidt) [RHEL-139535]
  - ixgb: Remove useless DMA-32 fallback configuration (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_build_skb() (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_consume_skb() (Michal Schmidt) [RHEL-139535]
  - fm10k: Fix syntax errors in comments (Michal Schmidt) [RHEL-139535]
  - e100: fix device suspend/resume (Michal Schmidt) [RHEL-139535]
  - ethernet: ixgb: use eth_hw_addr_set() (Michal Schmidt) [RHEL-139535]
  - ethernet: constify references to netdev->dev_addr in drivers [ixgb] (Michal Schmidt) [RHEL-139535]
  - ethernet: use eth_hw_addr_set() for dev->addr_len cases [intel] (Michal Schmidt) [RHEL-139535]
  - e100: fix buffer overrun in e100_get_regs (Michal Schmidt) [RHEL-139535]
  - e100: fix length calculation in e100_get_regs_len (Michal Schmidt) [RHEL-139535]
  - Doc: networking: Fox a typo in ice.rst (Michal Schmidt) [RHEL-139535]
  - e100: Avoid memcpy() over-reading of ETH_SS_STATS (Michal Schmidt) [RHEL-139535]
  - wifi: ath12k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - wifi: ath11k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - ALSA: update RHEL kconfigs for 6.18 upstream code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: properly initialize speaker_id for TAS2563 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6adm: the the copp device only during last instance (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6asm-dai: perform correct state check before closing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-tx-macro: fix SM6115 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: fix regmap leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: remove the reset operation in probe and remove (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for Lenovo platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for HP 200 G2i (Jaroslav Kysela) [RHEL-118911]
  - ALSA: realtek/alc288 fix headphone for MS Surface 2/3 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add Asus quirk for TAS amplifiers (Jaroslav Kysela) [RHEL-118911]
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40317}
  - ASoC: ops: fix snd_soc_get_volsw for sx controls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: support Q7.8 volume format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Always return 0 when a subsystem ID is found (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Convert FLOAT to S32 during blob selection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Prefer 32-bit DMIC blobs for 8-bit formats as well (Jaroslav Kysela) [RHEL-118911]
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Remove duplicated module macros (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Fix integer overflow in sample size validation (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68344}
  - ALSA: wavefront: Clear substream pointers on close (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68345}
  - ALSA: hda/tas2781: fix speaker id retrieval for multiple probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add match for ASUS Xbox Ally projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68346}
  - ASoC: amd: acp: update tdm channels for specific DAI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68753}
  - ALSA: uapi: Fix typo in asound.h comment (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68347}
  - ASoC: ak5558: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Audio is not resuming after s0ix (Jaroslav Kysela) [RHEL-118911]
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: catpt: Fix error path in hw_params() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_xcvr: clear the channel status control memory (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: add missing build config (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: nau8325: Silence uninitialized variables warnings (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: correct the wrong period (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong chip ID for reset variable check (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Fix missing dash in HIDE DisCo property (Jaroslav Kysela) [RHEL-118911]
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for HP ZBook X G2i platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED and Tas2781 for HP platform (Jaroslav Kysela) [RHEL-118911]
  - platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: au88x0: Fix incorrect error handling for PCI config reads (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Correct the wrong project ID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40275}
  - ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68281}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40269}
  - ALSA: hda/tas2781: Add new quirk for HP new projects (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: fix getting the wrong device number (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: va-macro: fix resource leak in probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2783A: Fix issues in firmware parsing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs4271: Fix regulator leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68205}
  - ASoC: da7213: Use component driver suspend/resume (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: cs35l56: Update firmware filename description for B0 silicon (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Enable mic on Vaio RPL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Fix sync error in consumer mode (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Fix build for sdw_utils (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: fix prepare clock stop failed (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_micfil: correct the endian format for DSD (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: fix bit order for DSD format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Use snd_codec format when initializing probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40344}
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add name_prefix for rt1321 part id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 (Jaroslav Kysela) [RHEL-118911]
  - ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix control pipe direction (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix vendor quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40162}
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add rt1321 part id to codec_info_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Generalize helper to clear IRQ status (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: Add support for QCS615 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,sm8250: Add QCS615 sound card (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Set tas2781_hda::tasdevice_priv::chip_id as TAS5825 in case of tas5825 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for Huawei Technologies Co., Ltd. CM-Q3 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Add MSI X870E Tomahawk to denylist (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40097}
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40098}
  - ASoC: rt722: add settings for rt722VB (Jaroslav Kysela) [RHEL-118911]
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Enable init_profile_id for device initialization (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Fix typo in docs (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: do not report invalid delay values (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Remove IRQ masking in suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Move IRQ enable/disable to encompass force suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: arizona: Make legacy gpiolib interface optional (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Add pin fix for HP ProDesk model (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add the initial mix for Presonus Studio 1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: doc: improved docs about quirk_flags in snd-usb-audio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: make param quirk_flags change-able in runtime (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: improve module param quirk_flags (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jaroslav Kysela) [RHEL-118911] {CVE-2025-39997}
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: document 'chan_map' member in snd_dec_opus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Set fw_regs table after getting REVID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix an error code in probe() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: stm32: sai: manage context in set_sysclk callback (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: fix signedness bug in wcd_dt_parse_micbias_info() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert MediaTek mt8183-mt6358 to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Convert MT8183 DA7219 sound card to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert mt8183-afe-pcm to dt-schema (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix spelling mistake "Perifpheral" -> "Peripheral" (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Remove unneeded semicolon (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't apply interface quirk to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - tas2783A: Add acpi match changes for Intel MTL (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: add machine driver changes (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: machine driver amp utility for TI devices (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Add soundwire based codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ops: improve snd_soc_get_volsw (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong description and register address on tas2781 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40132}
  - ASoC: qcom: qdsp6/audioreach: add support for offloading raw opus playback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: increase SNDRV_COMPRESS_VERSION minor version by 1 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: add raw opus codec define and opus decoder structs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Drop struct qmc_dai_chan (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Only request completion on last channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Ensure audio channels are ordered in TDM bus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: da7213: Convert to DEFINE_RUNTIME_DEV_PM_OPS() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move status_update callback to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move component ops to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move WCD_SDW_CH to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd: add common helper for wcd codecs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: make stub functions inline (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: set the comp soundwire port correctly (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40045}
  - ASoC: soc-dapm: add snd_soc_dapm_set_idle_bias() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step2 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step1 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: remove suspend_bias_off from snd_soc_dapm_context (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-card: add snd_soc_card_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: add snd_soc_component_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: use dapm->component instead of container_of() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_card() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_dev() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: spi/at73c213: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: add bindings for pm4125 audio codec (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40142}
  - ASoC: Intel: hda-sdw-bpt: set persistent_buffer false (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-generic: remove shared static buffer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: asihpi: Simplify error handling in PCM substream setup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: apple: mca: Add "apple,t8103-mca" compatible (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Remove redundant size arguments from strscpy() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: pcm1754: add pcm1754 dac driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,pcm1754: add binding documentation (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/dbri: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/cs4231: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/amd7930: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fcp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: fix scoped_guard done variable misuse (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ppc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd_ps3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: parisc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd-n64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sgio2audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: arm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Don't split string across lines (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add test for getting cal data from HP EFI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add HP-specific EFI variable for calibration data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add tests for cs_amp_get_vendor_spkid() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Check for vendor-specific speaker ID value (Jaroslav Kysela) [RHEL-118911]
  - efi: Add EFI_ACCESS_DENIED status code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add handling for Lenovo and HP UEFI speaker ID (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Rename defines for Cirrus Logic EFI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hrtimer: Avoid direct access to hrtimer clockbase (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40121}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Add default value for burst_bclkdiv (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Remove unused struct tlv320dac33_platform_data and header file tlv320dac33-plat.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_AVAIL64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_TSTAMP64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add 64-bit safe timestamp infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: scarlett2: Add Vocaster speaker/headphone mute controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Send the PCM period elapsed notification properly (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply "mixer_min_mute" quirks on some devices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add quirk QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: rename QUIRK_FLAG_MIXER_MIN_MUTE to QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Shutdown jack detection on suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Disable IRQs in system suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Store IRQ domain in codec private data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Rename system suspend callback and fix debug print (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: wlf,wm8960: Document routing strings (pin names) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-wsa-macro: add Codev version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-macro: add Codec version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: add compatible for glymur SoC (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: set card driver name from match data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: ssm4567: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5682: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5663: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5514: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt298: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt286: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt274: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: probe: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: nau8825: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98927: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98373: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98357a: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: i2stest: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: es8336: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: dmic: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: da7219: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: hda: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/conexant: Fix typos in comments (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Fix serialization in snd_rme32_capture_adat_open() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Fix a less than zero check on a u32 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use is_s4_resume() macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: topology: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix potential null pointer dereference (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40013}
  - soundwire: Use min() to improve code (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: Drop dev_pm_domain_detach() call (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_kcontrol_component() to snd_soc_kcontrol_to_component() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename dapm_kcontrol_get_value() to snd_soc_dapm_kcontrol_get_value() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_dapm() to snd_soc_dapm_kcontrol_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_widget() to snd_soc_dapm_kcontrol_to_widget() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: misc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: virtio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97bus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atmel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pxa2xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aaci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vxpocket: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pdaudiocf: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: at73c213: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: xen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for preset locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: caiaq: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bcd2000: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: qcom: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usx2y: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-u16550: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: portman2x4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mts64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mtpav: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mpu401: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dummy: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sscape: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu8000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opti9xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3sa2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: msnd: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es18xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1688: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmi8330: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1816a: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ymfpci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx222: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: via82xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sonicvibes: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme9652: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdspm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdsp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme96: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcxhr: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mixart: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: maestro3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx6464es: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: intel8x0: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: fm801: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1938: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for emu1010 FPGA locking (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs5535audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ca0106: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bt87x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1889: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als4000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als300: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: azt3328: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ali5451: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: isight: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sof: ipc4-topology: Add support to sched_domain attribute (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Introduce sof_client_dev_entry structure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Convert sof_client_dev_to_sof_dev into function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes: Add available points_info(), IPC4 only (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Human readable debugfs "probe_points" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Add sof_client_ipc4_find_swidget_by_id() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: IPC4: Add GET macros for module id and module instance id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Implement ipc4_probes_points_info (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for float sample type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for 8-bit formats (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: Add fixup for channels (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/rw: Cleanup with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/synth: Clean up with guard and auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/midi: Cleanup with guard and auto-cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss: Clean up core code with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up fifo locking with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up queue locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up port locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use auto-cleanup for client refcounting (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use guard() for mutex and rwsem locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up spin lock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Simplify internal command operation from OSS layer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ext: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/analog: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/component: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs8409: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs35l41: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use guard() for mutex locks and COEF locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use auto cleanup macros for DSP loader locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Introduce auto cleanup macros for PM (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: Internally link to Writing an ALSA Driver docs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: only detect codecs when HDA DSP probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: split codec mask detect and programming UNSOL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Remove (explicitly) unused header (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: adau1977: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Simplify dmi_match_quirk() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx_core: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: oss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fixes for handshake, MIDI out and cleanup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic32x4: use dev_err_probe() for regulators (Jaroslav Kysela) [RHEL-118911]
  - ASoC: imx-hdmi: remove cpu_pdev related code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: omap-twl4030: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,twl4030-audio: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: test-component: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for SMECNS module (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: sort modules based on hex ids (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix typos in I2S_INTF_TYPE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for static calibration (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add documentation for i2s interface type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: deprecate AR_TKN_U32_MODULE_[IN/OUT]_PORTS (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Use le16_to_cpu() for product ID comparison (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,wsa8830: Add reset-gpios for shared line (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Do not share the name pointer between components (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40338}
  - ASoC: Intel: avs: Drop pcm.h dependency for probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add infrastructure for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add deep sleep command (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio capture and decoding (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio playback and feedback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add PCM core infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add initial driver for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wl1273: Remove (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt1321: Add RT1321 amplifier support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in print_device_list() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use min() to simplify snd_hda_get_devices() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sst: Remove redundant semicolons (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in snd_hda_get_num_devices() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use auto-cleanup for shutdown locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Convert brcm,bcm2835-i2s to DT schema (Jaroslav Kysela) [RHEL-118911]
  - soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: realtek,alc5623: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fix "dependant"->"dependent" (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Replace manual mutex/spinlock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: 6fire: Clean ups with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: scarlett2: Clean ups with guard() and __free() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Add TAS5825 support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix spelling mistake "dismatch" -> "mismatch" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs48l32: Use PTR_ERR_OR_ZERO() to simplify code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: add some vendor registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: imx: Remove error print for devm_add_action_or_reset() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add keyword "init" in profile section (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dmaengine_pcm: Add port_window_size to DAI dma data struct (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Drop imx-audio-sgtl5000.txt (Jaroslav Kysela) [RHEL-118911]
  - ASoC: pxa: add GPIOLIB_LEGACY dependency (Jaroslav Kysela) [RHEL-118911]
  - ASoC: add GPIOLIB_LEGACY dependency where needed (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_init_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_force_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_init_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_get_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Conditional-path support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Parse conditional path tuples (Jaroslav Kysela) [RHEL-118911]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-684.el9]
changelog:
  - new config in drivers/phy (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Izabela Bakollari) [RHEL-121401]
  - r8169: make Kconfig option for LED support user-visible (Izabela Bakollari) [RHEL-121401]
  - net: phy: use new iterator mdiobus_for_each_phy in mdiobus_prevent_c45_scan (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: simplify return in ksz9477_phy_errata() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: remove old sfp_parse_* functions (Izabela Bakollari) [RHEL-121401]
  - net: sfp: convert sfp quirks to modify struct sfp_module_support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: pre-parse the module support (Izabela Bakollari) [RHEL-121401]
  - of: mdio: warn if deprecated fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: fix duplex setting error for phy leds (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix clk warning when removing the driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: enable serdes option mode for RTL8226-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix RTL8211F wake-on-lan support (Izabela Bakollari) [RHEL-121401]
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Izabela Bakollari) [RHEL-121401]
  - phy: micrel: add Signal Quality Indicator (SQI) support for KSZ9477 switch PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: assign default match function for non-PHY MDIO devices (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add cable test support for KSZ9477-class PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add RX error counter support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add MDI/MDI-X control support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: remove KSZ9477 EEE quirks now handled by phylink (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume (Izabela Bakollari) [RHEL-121401]
  - net: phy: drop phy_settings and the associated lookup helpers (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Dynamically control external clock of KSZ PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: c45: improve handling of disabled EEE modes in generic ethtool functions (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: remove call to devm_hwmon_sanitize_name (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: make HWMON support a user-visible Kconfig symbol (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add hwmon support for temp sensor on RTL822x (Izabela Bakollari) [RHEL-121401]
  - net: sfp: return the number of written bytes for smbus single byte access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: Add power management and soft reset support (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Izabela Bakollari) [RHEL-121401]
  - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Izabela Bakollari) [RHEL-121401]
  - net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add SQI support for LAN867x Rev.D0 PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add SQI and SQI+ support for OATC14 10Base-T1S PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: implement configurability for SGMII in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: add hwtstamp_get callback to phy drivers (Izabela Bakollari) [RHEL-121401]
  - phy: rename hwtstamp callback to hwtstamp_set (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86252 and MxL86282 (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86211C (Izabela Bakollari) [RHEL-121401]
  - net: mdio: eliminate kdoc warnings in mdio_device.c and mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Izabela Bakollari) [RHEL-121401]
  - net: ethtool: Add support for 1600Gbps speed (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Simplify register value passing (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Fix software power-down ready condition (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_phy_eee() helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr1 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate has_phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_rgmii_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add missing supported link modes for the fixed-link (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814: Enable in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove setting supported/advertised modes from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Handle devm_phy_package_join() failure in vsc85xx_probe_common() (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Add support for PHY LED control (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Consolidate probe functions into a common helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Simplify LED mode update using phy_modify() (Izabela Bakollari) [RHEL-121401]
  - net: mdio: fix resource leak in mdiobus_register_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814 fix reset of the QSGMII interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s:: add cable diagnostic support for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add OATC14 10BASE-T1S PHY cable diagnostic support (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_device members pause and asym_pause bitfield bits (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce internal API for PHY MSE diagnostics (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add interrupt support for RTL8221B (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: configure link status control for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add support for Microchip LAN867X Rev.D0 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: add iterator mdiobus_for_each_phy (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83869: fix STRAP_OPMODE bitmask (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8531 (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Add RTL8224 cable testing support (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: Disable EEE support as not implemented (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed wake-on-lan PHY speed control (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed MAC Wake-on-Lan support (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_may_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_can_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: always set shared->phydev for LAN8814 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix typos in comments (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix rtl8221b-vm-cg name (Izabela Bakollari) [RHEL-121401]
  - net: mdio: use macro module_driver to avoid boilerplate code (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: Fix GMII/MII/MII-Lite selection (Izabela Bakollari) [RHEL-121401]
  - net: doc: Fix typos in docs (Izabela Bakollari) [RHEL-121401]
  - net: sfp: don't include swphy.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: annotate linkmode initializers as not used after init phase (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_unregister (Izabela Bakollari) [RHEL-121401]
  - docs: networking: phy: clarify abbreviation "PAL" (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix lan8814_config_init (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix default LED behaviour (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: improve phydev and driver removal handling (Izabela Bakollari) [RHEL-121401]
  - net: phy: ax88796b: Replace hard-coded values with PHY_ID_MATCH_MODEL() (Izabela Bakollari) [RHEL-121401]
  - net: phy: update all PHYs to use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: provide sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_copy() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: use %pe in print format (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add Fast link failure support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear link parameters on admin link down (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: use bitmap_empty() where appropriate (Izabela Bakollari) [RHEL-121401]
  - net: phylink: warn if deprecated array-style fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: Convert to phy_id_compare_model() (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_model() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Update Kconfig help text (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove two function stubs (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: delete aqr_firmware_read_fingerprint() prototype (Izabela Bakollari) [RHEL-121401]
  - net: phy: NXP_TJA11XX: Update Kconfig with TJA1102 support (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: create and store a 64-bit firmware image fingerprint (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: report and configure in-band autoneg capabilities (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: print global syscfg registers (Izabela Bakollari) [RHEL-121401]
  - net: phy: transfer phy_config_inband() locking responsibility to phylink (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add PTP support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce function __lan8814_ptp_probe_once (Izabela Bakollari) [RHEL-121401]
  - net: phylink: disable autoneg for interfaces that have no inband (Izabela Bakollari) [RHEL-121401]
  - net: phylink: provide phylink_get_inband_type() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_weight() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for FLYPRO copper SFP+ module (Izabela Bakollari) [RHEL-121401]
  - net: phy: mtk-2p5ge: Add LED support for MT7988 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: simplify fixed_mdio_read (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: support for TRIGGER_NETDEV_LINK on RTL8211E and RTL8211F (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix when PTP clock is register and unregister (Izabela Bakollari) [RHEL-121401]
  - net: phy: as21xxx: better handle PHY HW reset on soft-reboot (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_vendor() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for MxL86111 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: fix indentation in struct phy_driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for led_brightness_set op (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: add support for AQR115 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: promote AQR813 and AQR114C to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename aqr113c_config_init() to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reimplement aqcs109_config_init() as aqr_gen2_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen3_config_init() for AQR112 and AQR412(C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen2_fill_interface_modes() for AQCS109 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge and rename aqr105_read_status() and aqr107_read_status() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: use cached GLOBAL_CFG registers in aqr107_read_rate() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: remove handling for get_rate_matching(PHY_INTERFACE_MODE_NA) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: save a local shadow of GLOBAL_CFG register values (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: fill supported_interfaces for all aqr_gen2_config_init() callers (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename some aqr107 functions according to generation (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reorder AQR113C PMD Global Transmit Disable bit clearing with supported_interfaces (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge aqr113c_fill_interface_modes() into aqr107_fill_interface_modes() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename AQR412 to AQR412C and add real AQR412 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Replace hardcoded pages with defines (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce lanphy_modify_page_reg (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Start using PHY_ID_MATCH_MODEL (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix timestamping for vsc8584 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed: remove usage of a faux device (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: report and configure in-band auto-negotiation for SGMII/QSGMII (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: convert RTL8226-CG to c45 only (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521 (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: fix the PHY ID mismatch issue when using C45 (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: add proper reset flags for LAN8710A (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix parsing of unicast frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Enable WoL support using shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: Add PHY counter support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Don't register LEDs for genphy (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add ksz9131_resume() (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: PHY initialization (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm5481x: MII-Lite activation (Izabela Bakollari) [RHEL-121401]
  - net: phy: MII-Lite PHY interface mode (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Izabela Bakollari) [RHEL-121401]
  - net: phy: declare package-related struct members only if CONFIG_PHY_PACKAGE is enabled (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink_sfp_select_interface_speed() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: clear SFP interfaces when not in use (Izabela Bakollari) [RHEL-121401]
  - net: phylink: restrict SFP interfaces to those that are supported (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: move the WoL function to shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: air_en8811h: Introduce resume/suspend and clk_restore_context to ensure correct CKO settings after network interface reinitialization. (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add error handling to rtl8211f_get_wol (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add interface types for 50G and 100G (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: at803x: Add Qualcomm IPQ5018 Internal PHY support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add c45_phy_ids sysfs directory entry (Izabela Bakollari) [RHEL-121401]
  - net: phy: add flag is_genphy_driven to struct phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: add Kconfig symbol PHY_PACKAGE (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_package a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: make mdio consumer / device layer a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: remove Kconfig symbol MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: factor out provider part from mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - mdio: fix CONFIG_MDIO_DEVRES selects (Izabela Bakollari) [RHEL-121401]
  - net: ethernet: Add missing depends on MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: move __phy_package_[read|write]_mmd to phy_package.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve rgmii_clock() documentation (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: switch to adaptive polling and remove random delays (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: remove redundant 600ms post-reset delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: implement soft reset with asymmetric delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: directly copy struct mdio_board_info in mdiobus_register_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve mdio-boardinfo.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of struct mdio_board_entry to mdio-boardinfo.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify mdiobus_setup_mdiodev_from_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify phy_get_internal_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of genphy_c45_driver to phy_device.c (Izabela Bakollari) [RHEL-121401]
  - net/mdiobus: Fix potential out-of-bounds read/write access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Fix memory leak when using one step timestamping (Izabela Bakollari) [RHEL-121401]
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear phydev->devlink when the link is deleted (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: Add Airoha AN7583 PHY support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add support for Aeonsemi AS21xxx PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce genphy_match_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm87xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: pass PHY driver to .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: transition to the faux device interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: HWMON support for standalone versions of RTL8221B and RTL8251 (Izabela Bakollari) [RHEL-121401]
  - xen/netfront: stop tx queues during live migration (Thilak KN) [RHEL-134437]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-685.el9]
changelog:
  - gpio: tegra186: Fix GPIO name collisions for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Use generic macro for port definitions (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra256 (Jennifer Berringer) [RHEL-135121]
  - dt-bindings: gpio: Add Tegra256 support (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: fix resource handling in ACPI probe path (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Replace of_node_to_fwnode() with more suitable API (Jennifer Berringer) [RHEL-135121]
  - tools headers arm64: Add NVIDIA Olympus part (Charles Mirabile) [RHEL-138475]
  - perf arm-spe: Add NVIDIA Olympus to neoverse list (Charles Mirabile) [RHEL-138475]
  - soc/tegra: fuse: Do not register SoC device on ACPI boot (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Fix crash in tegra_fuse_readl() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add ACPI support for Tegra194 and Tegra234 (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to print SKU info (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to add lookups (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add tegra_acpi_init_apbmisc() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Refactor resource mapping (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use dev_err_probe for probe failures (Jennifer Berringer) [RHEL-135125]
  - mm/util: Introduce kmemdup_array() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use devm_platform_get_and_ioremap_resource() (Jennifer Berringer) [RHEL-135125]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-686.el9]
changelog:
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]
  - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]
  - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]
  - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.el9]
changelog:
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]
  - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]
  - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.1.1.el9_8]
changelog:
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}
  - redhat: update self-test data (Patrick Talbert)
  - redhat: set defaults for 9.8 (Patrick Talbert)
  - gitlab-ci: disttag override for 9.8 (Patrick Talbert)
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.2.1.el9_8]
changelog:
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]
  - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]
  - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]
  - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.3.1.el9_8]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
  - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
  - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.4.1.el9_8]
changelog:
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: Tao Liu <ltao@redhat.com> - 2.0.29-12
changelog:
  - Allow "sudo kdumpctl" for LUKS dump target
  - Restore SELinux label of crypttab file
  - Allow kdump.service to access LUKS volume keys
  - Wait for LUKS configfs API to be ready
  - Change LUKS volume key prefix to kdump-cryptsetup:vk-
  - Remove unused LUKS volume keys from keyring
  - Limit LUKS support to x86_64
  - Add kdumpctl setup-crypttab subcommand
  - Return LUKS devices in the form of UUIDs directly
  - Fix SC2181 issues in kdump-udev-throttler
  - LUKS: make /usr writable
  - Address CPU/memory hot plugging for kdump LUKS support
  - shfmt kdump-udev-throttler
  - Use cryptsetup --link-vk-to-keyring to save volume keys
  - Support dumping to a LUKS-encrypted target
  - Add a helper function to get uuid by MAJ:MIN


author: Pingfan Liu <piliu@redhat.com> - 2.0.29-14
changelog:
  - powerpc: Set nr_cpus=16 for kdump kernel
  - powerpc: consider CPU count while calculating crashkernel value
  - Use all available CPUs to collect dump


author: Lichen Liu <lichliu@redhat.com> - 2.0.29-15
changelog:
  - sysconfig: use initramfs_options to reduce memory usage
  - kdump-lib-initramfs: rewrite kdump_get_conf_val
  - kdump-lib-initramfs: Fix performance regression in kdump_get_conf_val


author: Rado Vrbovsky <rvrbovsk@redhat.com> 0.9.7-10
changelog:
  - Rebase kpatch with upstream to v0.9.10 (RHEL-113130)
  - Provide a list of CVEs currently patched using live patches (RHEL-103845)


author: Jose Guisado <jguisado@redhat.com> [1-3.el9_7]
changelog:
  - kernel: Linux kernel: vsock vulnerability may lead to memory corruption [RHEL-147109] {CVE-2025-40248}


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Karel Zak <kzak@redhat.com> 2.37.4-22
changelog:
  - fix RHEL-113638 - lscpu: update ARM identifiers
  - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification


author: Karel Zak <kzak@redhat.com> 2.37.4-23
changelog:
  - fix RHEL-123527 - mount: improve --all documentation
  - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation


author: José Expósito <jexposit@redhat.com> - 2.4.123-2
changelog:
  - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches")
    libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x
    Resolves: https://issues.redhat.com/browse/RHEL-53869


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-38.2
changelog:
  - Replace statfs64 with statfs (RHEL-127104)
  - NFS export symlink vulnerability fix (RHEL-127104)
  - mountd: Minor refactor of get_rootfh() (RHEL-127104)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)
    Resolves: CVE-2025-12801


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.2
changelog:
  - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148970)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148403)
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147343)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.4
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161436)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131594)
  - CVE-2025-65018: heap buffer overflow (RHEL-131603)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
changelog:
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-18
changelog:
  - Resolves: RHEL-150661
  - Resolves: CVE-2025-4877
  - Resolves: CVE-2025-4878
  - Resolves: CVE-2025-5351
  - Resolves: CVE-2025-8114
  - Resolves: CVE-2025-8277
  - Resolves: CVE-2026-0964
  - Resolves: CVE-2026-0965
  - Resolves: CVE-2026-0966
  - Resolves: CVE-2026-0967
  - Resolves: CVE-2026-0968


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20250812-1.20260210-1
changelog:
  - Update Intel CPU microcode to microcode-20260210 release (RHEL-152424)
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-6a-06/87: Ice Lake-X: d000410 to d000421
    06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1
    06-7e-05/80: Ice Lake-L: 00ca to 00cc
    06-8c-01/80: Tiger Lake: 00bc to 00be
    06-8c-02/c2: Tiger Lake: 003c to 003e
    06-8d-01/c2: Tiger Lake-H: 0056 to 0058
    06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661
    06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421
    06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661
    06-97-02/07: Alder Lake: 003d to 003e
    06-97-05/07: Alder Lake: 003d to 003e
    06-9a-03/80: Alder Lake-L: 043a to 043b
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-a7-01/02: Rocket Lake: 0064 to 0065
    06-aa-04/e6: Meteor Lake-L: 0025 to 0028
    06-ad-01/20: Granite Rapids-X: a000124 to a000133
    06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405
    06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3
    06-b5-00/80: Arrow Lake-U: 000a to 000d
    06-b7-01/32: Raptor Lake: 0132 to 0133
    06-ba-02/e0: Raptor Lake-P: 6133 to 6134
    06-ba-03/e0: Raptor Lake-P: 6133 to 6134
    06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021
    06-bf-02/07: Raptor Lake-S: 003d to 003e
    06-bf-05/07: Raptor Lake-S: 003d to 003e
    06-c5-02/82: Arrow Lake-H: 011a to 011b
    06-c6-02/82: Arrow Lake: 011a to 011b
    06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3
  Resolves: RHEL-152424


author: Leo Sandoval <lsandova@redhat.com> - 0.7.2-2
changelog:
  - Rebase several patches from upstream which:
    - Introduce --is-sb-enabled parameter and better return codes
    - Remove unused int_to_b64()
    - Show help on unsupported systems
  - Resolves: #RHEL-90837


author: Phil Sutter <psutter@redhat.com> [1.0.9-6.el9]
changelog:
  - Revert doc/ part of "exthdr: add boolean DCCP option matching" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "meta: introduce meta broute support" (Phil Sutter) [RHEL-126817]
  - Revert doc/ part of "src: add tcp option reset support" (Phil Sutter) [RHEL-126817]
  - spec: Update expected test suite results (Phil Sutter) [RHEL-126817]


author: Than Ngo <than@redhat.com> - 3.25.0-4.1
changelog:
  - Fix unwrapping of attribute bound EC keys
  - Fix private secure key blob import
    Resolves: RHEL-131644


author: Than Ngo <than@redhat.com> - 3.26.0-1
changelog:
  - Resolves: RHEL-75139, ep11 token BLS support
  - Resolves: RHEL-85381, ep11 token: ML-KEM and ML-DSA support
  - Resolves: RHEL-85384. cca token: ML-KEM and ML-DSA support
  - Resolves: RHEL-100059, openCryptoki 3.26.0


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-48
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155823


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-49
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164752
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166249
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166233
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166201
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166217


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-119515
  - Canonicalize username when matching a user
    Resolves: RHEL-118372


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
changelog:
  - Enable support for DSA keys
    Resolves: RHEL-127624
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-133959
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-133960


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155824


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95502
  - Build tests in check and without LTO
    Resolves: RHEL-111633


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-136895
    Resolves: RHEL-142004
    Resolves: RHEL-142012
    Resolves: RHEL-142020
    Resolves: RHEL-142024
    Resolves: RHEL-142028
    Resolves: RHEL-142032
    Resolves: RHEL-142036
    Resolves: RHEL-142040
    Resolves: RHEL-142044
    Resolves: RHEL-142048
    Resolves: RHEL-142052
    Resolves: RHEL-142056


author: Petr Lautrbach <lautrbach@redhat.com> - 3.6-5
changelog:
  - sandbox/seunshare: Replace system() with execv() to prevent shell injection
  - seunshare: fix the frail tmpdir cleanup


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-3.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143108 RHEL-143169 RHEL-144893


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.48-1
changelog:
  - Translated using Weblate (Korean) (simmon@nplob.com)
  - ci: bump actions/upload-artifact from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)
  - feat: [1.29] Added dnf4 warning about skewed clock (jhnidek@redhat.com)
  - fix: [1.29] Require findutils in .spec file (jhnidek@redhat.com)
  - ci: bump actions/checkout from 4 to 5
    (49699333+dependabot[bot]@users.noreply.github.com)


author: Jiri Hnidek <jhnidek@redhat.com> 1.29.49-1
changelog:
  - RHEL-126157: Update GCP to Google Cloud in log messages (crag@redhat.com)
  - fix: Update user-facing GCP refrences to Google Cloud (crag@redhat.com)
  - feat: check if --set arg is empty when the environments module is called
    (manuelcanorojo@gmail.com)
  - feat: Added more debug prints to cloud-what (jhnidek@redhat.com)
  - fix(test): Fix unit test of aws (jhnidek@redhat.com)
  - fix: Fix getting AWS IMDSv2 signature (jhnidek@redhat.com)
  - chore: Make new black happy again (jhnidek@redhat.com)
  - chore: Increased log level of messages (jhnidek@redhat.com)
  - fix: Use IMDSv2 for signature first (jhnidek@redhat.com)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Translated using Weblate (Georgian) (noreply-mt-weblate-translation-
    memory@weblate.org)
  - Translated using Weblate (Georgian) (temuri.doghonadze@gmail.com)
  - Added translation using Weblate (Finnish) (noreply-addon-
    languages@weblate.org)
  - fix: TypeError in _get_tls_handshake_info type hinting (macano@redhat.com)
  - feat: added signature type log in TLS handshake (macano@redhat.com)
  - feat: added internal method to get tls handshake info
    (manuelcanorojo@gmail.com)
  - ci: bump actions/upload-artifact from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)
  - Fix profile upload because of missing self.cp (suttner@atix.de)
  - Fix upload profile if rhsmcertd is not running at all (suttner@atix.de)
  - ci: bump actions/checkout from 5 to 6
    (49699333+dependabot[bot]@users.noreply.github.com)


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143117
  Resolves: RHEL-143174
  Resolves: RHEL-144897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143117, RHEL-143174, RHEL-144897


author: John Kacur <jkacur@redhat.com> - 0.7.4-2
changelog:
  - Update setup.py for older distributions
  - Use explicit setup.py build commands
  Resolves: RHEL-119895


author: Veronika Doubkova <vdoubkov@redhat.com> - 9.7-0.8
changelog:
  - Refactor SB certificates to versioned files with symlinks and revert UKI to 504
  - Resolves: RHELBLD-17477


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.8
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150628)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-40
changelog:
  - Improve error handling on keystore load (RHEL-114837)
  - Sort files before passing to file attr dependency generators (RHEL-95376)


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.68-1
changelog:
  - Allow insights-client manage /etc symlinks
  Resolves: RHEL-108826
  - Allow insights-client get attributes of the rpm executable
  Resolves: RHEL-127329
  - Allow ras-mc-ctl get attributes of the kmod executable
  Resolves: RHEL-103975
  - Fix files_delete_boot_symlinks() to contain delete_lnk_files_pattern
  Resolves: RHEL-101155
  - Allow bootupd delete symlinks in the /boot directory
  Resolves: RHEL-101155
  - Update policy for bootupd
  Resolves: RHEL-101155
  - Allow create kerberos files in postgresql db home
  Resolves: RHEL-123225


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.69-1
changelog:
  - Allow sysadm access to TPM
  Resolves: RHEL-119055
  - Update policy for dhcpc_hook_t
  Resolves: RHEL-113941
  - Allow stap server read virtual memory sysctls
  Resolves: RHEL-114157
  - Allow login_userdomain watch /home and /var directories
  Resolves: RHEL-119686
  - Allow login_userdomain read lastlog
  Resolves: RHEL-119686
  - Allow staff role read/write cockpit-session unix stream sockets
  Resolves: RHEL-108068
  - Label /usr/libexec/dhcpcd-run-hooks with dhcpc_hook_exec_t
  Resolves: RHEL-113941


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.70-1
changelog:
  - Add the rpm_signal() interface
  Related: RHEL-108826
  - Allow tuned_t use its private tmpfs files
  Related: RHEL-108826
  - Allow kdump search kdumpctl_tmp_t directories
  Resolves: RHEL-66119


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.71-1
changelog:
  - Revert "Allow NM nvme dispatcher script start systemd services"
  Resolves: RHEL-111946
  - Allow ssh_agent_type create a sockfile in /run/user/USERID
  Resolves: RHEL-121936
  - Allow NM nvme dispatcher script start systemd services
  Resolves: RHEL-111946
  - Allow aide get attributes of a filesystem with extended attributes
  Resolves: RHEL-121480
  - Label miscellaneous /dev/papr-* devices
  Resolves: RHEL-129879


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.72-1
changelog:
  - Add insights_client service interfaces
  Related: RHEL-140893
  - Confine rhc-worker-playbook.worker and rhc-playbook-verifier
  Resolves: RHEL-132748
  - Allow gpg manage rpm cache
  Related: RHEL-108775
  - Allow gpg read rpm cache
  Related: RHEL-108775
  - Allow aide get attributes of tmpfs and devtmpfs filesystems
  Resolves: RHEL-121480
  - Allow rules for confined users logged in plasma
  Resolves: RHEL-133898
  - Allow login_userdomain watch lnk_files in /usr
  Resolves: RHEL-133898


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.73-1
changelog:
  - Add the fs_write_tmpfs_files() interface
  Resolves: RHEL-142141
  - Dontaudit aide the execmem permission
  Resolves: RHEL-121480
  - Update gpg policy for interactions with rhc-playbook-verifier
  Resolves: RHEL-132748
  - Allow rhc_playbook_verifier_t stream connect to itself
  Resolves: RHEL-132748
  - Update policy for rhc-worker-playbook
  Resolves: RHEL-132748
  - Allow traceroute_t bind rawip sockets to unreserved ports
  Resolves: RHEL-130267
  - Revert "Allow traceroute_t bind rawip sockets to unreserved ports"
  Related: RHEL-130267
  - Allow sudodomain connect to gkeyringd over a unix stream socket
  Resolves: RHEL-121158
  - Allow samba-bgqd send to smbd over a unix datagram socket
  Resolves: RHEL-95985
  - Allow ssh_agent_type manage generic cache home files
  Resolves: RHEL-121165
  - Label /usr/libexec/openssh/ssh-pkcs11-helper with ssh_agent_exec_t
  Resolves: RHEL-121165
  - Allow boothd connect to systemd-machined over a unix socket
  Resolves: RHEL-140882


author: Zdenek Pytela <zpytela@redhat.com> - 38.1.74-1
changelog:
  - Label /run/insights-client.ppid with insights_client_run_t
  Resolves: RHEL-146688
  - Update gpg_role() interface with unix_stream_socket permissions
  Resolves: RHEL-128542


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-2
changelog:
  - Request to backport support for regex in sudo [rhel-9]
  Resolves: RHEL-1376
  - Rebase of sudo to 1.9.17p2 [rhel-9]
  Resolves: RHEL-128623
  - sudo passes SHELL environment variable twice to the shell being executed [rhel-9]
  Resolves: RHEL-127359


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-15
changelog:
  RHEL 9.7.0 ERRATUM
  - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166065


author: systemd maintenance team <systemd-maint@redhat.com> - 252-57
changelog:
  - Revert "boot: Use EFI_BOOT_MANAGER_POLICY_PROTOCOL to connect console devices" (RHEL-108596)
  - boot: Use correct memory type for allocations (RHEL-108555)
  - meson: /etc/systemd/network is also used by udevd (RHEL-109096)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-31756)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-31756)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-31756)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-31756)
  - core: do not disconnect from bus when failed to install signal match (RHEL-31756)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-31756)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-31756)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-31756)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-31756)
  - core/manager: drop duplicate bus track deserialization (RHEL-31756)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-31756)
  - shell completion: add kernel-identify/inspect verbs for bootctl (RHEL-108576)
  - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-109488)
  - test-time-util: disable failing tests (RHEL-109488)
  - test: test parse_timestamp() in various timezone (RHEL-109488)
  - systemctl: logind: add missing asserts (RHEL-109488)
  - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-109488)
  - systemctl: add option --when for scheduled shutdown (RHEL-109488)
  - test-time-util: add test cases to invalidate "show" and "cancel" (RHEL-109488)
  - Introduce RET_GATHER and use it in src/shared/ (RHEL-108598)
  - fd-util: don't eat up errors in fd_cloexec_many (RHEL-108598)
  - sd-bus: refuse to send messages with an invalid string (RHEL-108584)
  - test: check if we correctly handle invalid UTF-8 in mount stuff (RHEL-108584)
  - test: fix a typo in the cleanup stuff (RHEL-108584)
  - test: explicitly specify a UTF-8 locale for UTF-8 shenanigans (RHEL-108584)
  - test: use the correct file name when restoring the original fstab (RHEL-108584)
  - core: escape UTF-8 in mount unit Where field before sending to clients (RHEL-108584)
  - Revert "test-time-util: disable failing tests" (RHEL-109488)
  - test: use get_timezones() to iterate all known timezones (RHEL-109488)
  - test-time-util: do not fail on DST change (RHEL-109488)
  - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-109488)
  - test-time-util: do more suppression of time zone checks (RHEL-109488)
  - test-time-util: fix truncation of usec to sec (RHEL-109488)
  - test: unset TZ before timezone-sensitive unit tests are run (RHEL-109488)
  - meson: extend timeout for test-time-util (RHEL-109488)
  - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-109488)
  - time-util: align string table (RHEL-109488)
  - time-util: rename variables (RHEL-109488)
  - time-util: add assertions (RHEL-109488)
  - time-util: drop redundant else (RHEL-109488)
  - time-util: do not use strdupa() (RHEL-109488)
  - time-util: use result from startswith_no_case() (RHEL-109488)
  - time-util: use usec_add() and usec_sub_unsigned() (RHEL-109488)
  - time-util: shorten code a bit (RHEL-109488)
  - time-util: rename variables (RHEL-109488)
  - time-util: drop unnecessary assignment of timezone name (RHEL-109488)
  - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-109488)
  - time-util: fix typo (RHEL-109488)
  - ci: bump the tools tree to F42 (RHEL-109488)
  - journald: extend STDOUT_STREAMS_MAX to 64k (RHEL-111065)
  - Revert "Revert "udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT"" (RHEL-50103)
  - udev-builtin-net_id: ignore firmware_node/sun == 0 (RHEL-50103)
  - fundamental: fix compile check for explicit_bzero (RHEL-108568)
  - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-109488)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-59
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118215)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118215)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118215)
  - timer: don't run service immediately after restart of a timer (RHEL-118215)
  - test: store and compare just the property value (RHEL-118215)
  - test: make test-fd-util more lenient when using fd_move_above_stdio() (RHEL-114974)
  - basic: add PIDFS magic (#31709) (RHEL-114974)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-60
changelog:
  - man: fix a missing word (RHEL-115182)
  - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-97175)
  - cryptsetup: fix typo (RHEL-97175)
  - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-97175)
  - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138)
  - coredump: restore compatibility with older patterns (RHEL-104138)
  - coredump: use %d in kernel core pattern (RHEL-104138)
  - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138)
  - fd-util: introduce parse_fd() (RHEL-104138)
  - coredump: add support for new %F PIDFD specifier (RHEL-104138)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-61
changelog:
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215)
  - strv: introduce string_strv_hashmap_remove() (RHEL-14112)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-62
changelog:
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558)
  - timer: rebase last_trigger timestamp if needed (RHEL-118215)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-63
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859)
  - cryptsetup-generator: continue parsing after error (RHEL-127859)
  - cryptsetup-generator: parse all cmdline devices too (RHEL-127859)
  - cryptsetup-generator: always process cmdline devices (RHEL-127859)
  - logind: add "background-light" session class (RHEL-109833)
  - pam_systemd: honor session class provided via PAM environment (RHEL-109833)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-64
changelog:
  - core: fix array size in unit_log_resources() (RHEL-131338)
  - pid1: add env var to override default mount rate limit burst (RHEL-129153)
  - pid1: add env var to override default mount rate limit interval (RHEL-129153)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-65
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-66
changelog:
  - core/service: fix error cause in the log (RHEL-138414)
  - fstab-generator: drop assertions for mount opts (RHEL-92752)
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752)
  - core: reorder systemd arguments on reexec (RHEL-111135)
  - basic: add RuntimeScope enum (RHEL-137252)
  - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252)
  - sd-path: add support for XDG_STATE_HOME (RHEL-137252)
  - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252)
  - path tool: add some basic ansi highlighing (RHEL-137252)
  - execude: include RuntimeScope field in ExecParameters (RHEL-137252)
  - execute: remove redundant assignment (RHEL-137252)
  - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252)
  - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252)
  - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252)
  - execute: shorten some code by using RET_NERRNO() (RHEL-137252)
  - execute: shorten code by making use of laccess() return code properly (RHEL-137252)
  - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252)
  - test: add test for new XDG_STATE_HOME handling (RHEL-137252)
  - man: mention the newly-added XDG_STATE_HOME (RHEL-137252)
  - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252)
  - man: properly close XML tags (RHEL-137252)
  - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252)
  - test: use XDG_STATE_HOME for %S and %L (RHEL-137252)
  - man: fully adopt ~/.local/state/ (RHEL-137252)


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.27.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-123607
    - cpu-partitioning: autodetect dracut hook directory, systemd workaround
    - openshift: optimize TCP settings for high throughput and low latency
    - profiles: Set boost=1 in *-performance profiles
    - sap-hana: force latency to 70 us, not to C-states
    - man: fixed instance_acquire_devices example in tuned-adm man
    - spec: use correct python interpreter for documentation installation
    - sysctl: add reapply_sysctl_exclude option
    - ppd: ask tuned recommend for base profile


author: Patsy Griffin <patsy@redhat.com> - 2026a-1
changelog:
  - Update to tzdata-2026a (RHEL-154025)
    - Correct the transition times for Moldova.
    - The POSIXRULES option is now obsolete.


author: Petr Dancak <pdancak@redhat.com> - 2:8.2.2637-23.2
changelog:
  - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
  - RHEL-159629 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26
changelog:
  - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.1
changelog:
  - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Kate Hsuan <hpa@redhat.com> - 0.9.10-1
changelog:
  - Update to the upstream version 0.9.10
  - Update to 0.9.10
  - Fix bolt exits when opening an empty version file
  - Fix a NULL syspath variable causes SIGSEGV


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-1
changelog:
  - Rebase to 3.8.10
  - Revert defaulting to PBMAC1 in FIPS mode
  - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification


author: Tony Camuso <tcamuso@redhat.com> - 25.04-1
changelog:
  - Update to latest upstream.
  - Clean up install paths, drop obsolete patches, and improve flag injection
  handling
  - Replaced hard-coded install paths in Makefiles with sed-based DESTDIR
    fixes for lib, pqos, rdtset, and membw
    - Using sed during %prep is more robust and version-agnostic than patching,
      which requires rebasing each release
  - Relocated admin tools (pqos*, rdtset) from /usr/bin to /usr/sbin for FHS
    compliance
    - These tools require root and interact with system-level cache controls
  - Updated %files to match SONAME bump (libpqos.so.5 -> libpqos.so.6) introduced
    upstream
  - Dropped patches 0001, 0002, 0004, 0005
    - 0001/0002 replaced by sed
  - Ensure CFLAGS and LDFLAGS are augmented, not overridden by using sed to
    convert assignments to +=
    - Ensures compatibility with distro-injected flags (e.g. -O2 -flto=auto -ffat-lto-objects -fexceptions -g -grecord-gcc-switches -pipe -Wall -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wp,-D_GLIBCXX_ASSERTIONS -specs=/usr/lib/rpm/redhat/redhat-hardened-cc1 -fstack-protector-strong -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -m64 -march=x86-64-v2 -mtune=generic -fasynchronous-unwind-tables -fstack-clash-protection -fcf-protection,
      hardening) without carrying a version-specific patch
    Resolves: RHEL-122380


author: Ales Matej <amatej@redhat.com> - 0.69.0-18
changelog:
  - Fix a crash when parsing multiple key files fails (RHEL-145618)
  - Mark all protected packages as user installed for all transactions (RHEL-76112)
  - Add `filterUnneededExtraUserinstalled` and Python version to the API
  - Describe all problems even when there are protected removals (RHEL-115194)
  - Clearer error for protected package broken dependencies


author: RHEL Packaging Agent <jotnar@redhat.com> - 0.3.24-1
changelog:
  - Rebase to 0.3.24
  - Add missing libzstd-devel BuildRequires
  - Add missing files to the %files tests section
  - Resolves: RHEL-116442


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20251111-1
changelog:
  - Fix typo in /usr/share/microcode_ctl/ucode_with_caveats/intel-06-8f-08/config
  - Update Intel CPU microcode to microcode-20251111 release (RHEL-128199)
  - New microcode files (in hex):
    06-ae-01: Granite Rapids-D: revision 1000273
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-8f-07/87: Sapphire Rapids: 2b000643 to 2b000650
    06-8f-08/10: Sapphire Rapids with HBM: 2c000401 to 2c000410
    06-8f-08/87: Sapphire Rapids: 2b000643 to 2b000650
    06-97-02/07: Alder Lake: 003a to 003d
    06-97-05/07: Alder Lake: 003a to 003d
    06-9a-03/80: Alder Lake-L: 0437 to 043a
    06-9a-04/80: Alder Lake-L: 0437 to 043a
    06-9a-04/40: Arizona Beach (Atom C11xx): 000a to 000b
    06-ad-01/95: Granite Rapids-X: 10003d0 to 10003f0
    06-ad-01/20: Granite Rapids-X: a000100 to a000124
    06-af-03/01: Crestmont (Sierra Forest): 3000362 to 3000382
    06-b7-01/32: Raptor Lake: 012f to 0132
    06-ba-02/e0: Raptor Lake-P: 4129 to 6133
    06-ba-03/e0: Raptor Lake-P: 4129 to 6133
    06-bd-01/80: Lunar Lake: 0123 to 0125
    06-be-00/19: Gracemont (Alder Lake-N): 001d to 001e
    06-bf-02/07: Raptor Lake-S: 003a to 003d
    06-bf-05/07: Raptor Lake-S: 003a to 003d
    06-c5-02/82: Arrow Lake-H: 0119 to 011a
    06-c6-02/82: Arrow Lake: 0119 to 011a
    06-cf-02/87: Emerald Rapids: 210002b3 to 210002c0
  - Fixes errata RPL070/ADL083/LNL047/ARL054/SPR154/EMR147:
    "REP SCASB, REP CMPSB may return incorrect results when racing
    memory access with another core or thread" on Raptor Lake,
    Alder Lake, Lunar Lake, Arrow Lake, Sapphire Rapids, Emerald Rapids.


author: Denys Vlasenko <dvlasenk@redhat.com> - 4:20260210-1
changelog:
  - Update Intel CPU microcode to microcode-20260210 release (RHEL-151757)
  - Microcode files (/platform_mask shown) with revision updates (in hex):
    06-6a-06/87: Ice Lake-X: d000410 to d000421
    06-6c-01/10: Ice Lake-D: 10002e0 to 10002f1
    06-7e-05/80: Ice Lake-L: 00ca to 00cc
    06-8c-01/80: Tiger Lake: 00bc to 00be
    06-8c-02/c2: Tiger Lake: 003c to 003e
    06-8d-01/c2: Tiger Lake-H: 0056 to 0058
    06-8f-07/87: Sapphire Rapids: 2b000650 to 2b000661
    06-8f-08/10: Sapphire Rapids with HBM: 2c000410 to 2c000421
    06-8f-08/87: Sapphire Rapids: 2b000650 to 2b000661
    06-97-02/07: Alder Lake: 003d to 003e
    06-97-05/07: Alder Lake: 003d to 003e
    06-9a-03/80: Alder Lake-L: 043a to 043b
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-9a-04/40: Arizona Beach (Atom C11xx): 000b to 000c
    06-9a-04/80: Alder Lake-L: 043a to 043b
    06-a7-01/02: Rocket Lake: 0064 to 0065
    06-aa-04/e6: Meteor Lake-L: 0025 to 0028
    06-ad-01/20: Granite Rapids-X: a000124 to a000133
    06-ad-01/95: Granite Rapids-X: 10003f0 to 1000405
    06-ae-01/97: Granite Rapids-D: 1000273 to 10002f3
    06-b5-00/80: Arrow Lake-U: 000a to 000d
    06-b7-01/32: Raptor Lake: 0132 to 0133
    06-ba-02/e0: Raptor Lake-P: 6133 to 6134
    06-ba-03/e0: Raptor Lake-P: 6133 to 6134
    06-be-00/19: Gracemont (Alder Lake-N): 001e to 0021
    06-bf-02/07: Raptor Lake-S: 003d to 003e
    06-bf-05/07: Raptor Lake-S: 003d to 003e
    06-c5-02/82: Arrow Lake-H: 011a to 011b
    06-c6-02/82: Arrow Lake: 011a to 011b
    06-cf-02/87: Emerald Rapids: 210002c0 to 210002d3
  Resolves: RHEL-151757


author: Jakub Martisko <jamartis@redhat.com> - 4.8-10
changelog:
  - lib/dfa.c: Increase the maximum size of the transitions table
  - After changes introduced between sed 4.2 and 4.4, some regexps
    started to hit the table size limits. This lead to repeated deletion
    and rebuilding of the table, leading to massive performance drops.
    While the core issue is still present, this change should at least
    help by moving the threshold of the regexp complexity that triggers the 
    table rebuilds.
  - Resolves: RHEL-144026


author: Peter Jones <pjones@redhat.com> - 16.1-7.el9
changelog:
  - x86_64: add the "Microsoft UEFI CA 2023 signer" signature and the
    "Red Hat UEFI Publisher 2024" signatures to both shim binaries.
    Resolves: RHEL-144030


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-10
changelog:
  - Backport fix for regression in the --no-overwrite-dir option
    Upstream commit 4e742fc8674064a9fa00d4483d06aca48d5b0463, discussed
    in https://www.mail-archive.com/bug-tar@gnu.org/msg06445.html


author: Pavel Cahyna <pcahyna@redhat.com> - 2:1.34-11
changelog:
  - Add upstream patch to improve error message for --one-top-level
    with absolute path (unsupported as a result of CVE-2025-45582 fix)


author: John Kacur <jkacur@redhat.com> - 0.20-1
changelog:
  - Update to upstream version 0.20
  - Remove all patches (now included in upstream)
  - Remove oscilloscope (unsupported in RHEL)
  Resolves: RHEL-83079


author: Frédéric Bérat <fberat@redhat.com> - 2.34-265
changelog:
  - Fix null pointer dereference and assertion failures in __nss_database_get
    (bug 28940) (RHEL-150269)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.2.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172543]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172543] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172543]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172543] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172543]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.3.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-145355
  - Create sub-package for xrealmauthz KDC plugin
    Resolves: RHEL-67468
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-145359


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164753
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166250
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166234
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166202
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166218


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-3
changelog:
  - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166069


author: Tomas Halman <thalman@redhat.com> - 1.6-19.2
changelog:
  - Fix CVE-2026-40164 - Denial of Service via crafted JSON object causing hash collisions
  - Resolves: RHEL-168185


author: Julien Rische <jrische@redhat.com> - 1.21.1-10
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171590 RHEL-171596


author: Michal Ruprich <mruprich@redhat.com> - 3.2.5-6
changelog:
  - Resolves: RHEL-169151 - CVE-2026-41035 - Use-after-free vulnerability in extended attribute handling


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: Miro Hrončok <mhroncok@redhat.com> - 21.3.1-2
changelog:
  - Bump epoch for the virtual pip Provide, for this package to take precedence over python3.14-pip
  Resolves: RHEL-178095


author: Patsy Griffin <patsy@redhat.com> - 2026b-1
changelog:
  - Update to tzdata-2026b (RHEL-170784)
    - British Columbia’s 2026-03-08 spring forward is expected
      to be its last transition as it moves to permanent -07.


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-4
changelog:
  - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite)
  - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)
  - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread)
  - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass)
  - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free)
  - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread)
  - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite)
  - Fix CVE-2026-3832 (OCSP, Low, revocation bypass)
  - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel)
  - Fix upstream security issue #1808 (PSK rehandshake)
  - Fix upstream security issue #1810 (EKU OID prefix match)
  - Fix upstream security issue #1813 (pkcs11-provider persistent keys)
  - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import)
  - Fix upstream security issue #1819 (PKCS#11 trust removal error path)
  - Fix upstream security issue #1822 (SCT extension parser OOB read)
  - Fix upstream security issue #1841 (key zeroization in hybrid kex)
  - Fix upstream security issue #1823 (malformed certtool template)
  - Fix upstream security issue #1817 (session parameter loading robustness)
  - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving)
  - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in


author: Tomas Matus <tmatus@redhat.com> - 356.1-1
changelog:
  - ws: Prevent remote code execution with SSH argument injection (RHEL-158310)
  - node: update lodash dependency (RHEL-164196)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Phil Sutter <psutter@redhat.com> [1.0.9-7.el9]
changelog:
  - src: fix reset element support for interval set type (Phil Sutter) [RHEL-153461]
  - src: netlink: fix crash when ops doesn't support udata (Phil Sutter) [RHEL-153461]


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.5
changelog:
  - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
    via path traversal bypass


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.13.1.el9_8]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
  - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
  - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
  - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
  - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
  - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
  - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]


