# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.7.1.el9_6]
changelog:
  - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-77720]
  - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-77720]
  - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-77720]
  - scsi: qla2xxx: Fix use after free on unload (Ewan D. Milne) [RHEL-75828] {CVE-2024-56623}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.8.1.el9_6]
changelog:
  - net: stmmac: dwmac-tegra: Read iommu stream id from device tree (Izabela Bakollari) [RHEL-75649] {CVE-2025-21663}
  - net: stmmac: Fix zero-division error when disabling tc cbs (Izabela Bakollari) [RHEL-63931] {CVE-2024-49977}
  - configs: enable FW_CACHE on centos-stream/rhel 9 for nouveau (Dave Airlie) [RHEL-79929]
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (Radu Rendec) [RHEL-80224]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.9.1.el9_6]
changelog:
  - Revert "x86: bring back rep movsq for user access on CPUs without ERMS" (Herton R. Krzesinski) [RHEL-79780]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.10.1.el9_6]
changelog:
  - redhat: drop Y issues from changelog (Jan Stancek)
  - Reapply "perf util: Make util its own library" (Michael Petlan) [RHEL-79032]
  - iommu/vt-d: Fix suspicious RCU usage (Jerry Snitselaar) [RHEL-70102]
  - iommu/vt-d: Remove device comparison in context_setup_pass_through_cb (Jerry Snitselaar) [RHEL-70102]


author: Richard W.M. Jones <rjones@redhat.com> - 1:1.54.0-3
changelog:
  - Rebase to libguestfs 1.54.0
    resolves: RHEL-56809
  - Fix osinfo for Windows Server 2025
    resolves: RHEL-62935
  - Replace Jansson with json-c
    resolves: RHEL-65292


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.6-1
changelog:
  - Resolves: RHEL-70189 - Rebase SSSD for RHEL 9.6
  - Resolves: RHEL-67670 - Label DP_OPT_DYNDNS_REFRESH_OFFSET has no corresponding option [rhel-9]
  - Resolves: RHEL-68369 - sssd backend process segfaults when krb5.conf is invalid
  - Resolves: RHEL-66266 - SSSD needs an option to indicate if the LDAP server can run the exop with an anonymous bind or not [rhel-9]


author: Tomas Halman <thalman@redhat.com> - 0.17.0-9
changelog:
  - Fixing mellon_create_metadata.sh script
    Resolves: RHEL-35898
  - Publishing diagnostic module in CRB repository
    Resolves: RHEL-33585


author: Than Ngo <than@redhat.com> - 3.24.0-1
changelog:
  - Resolves: RHEL-50064, update to 3.24.0
  - Resolves: RHEL-50063, opencryptoki CCA Token support for x86_64 and ppc64le
  - Resolves: RHEL-50058, openCryptoki CCA token support of Dilithium
  - Resolves: RHEL-50056, openCryptoki cca token SHA3 support
  - Resolves: RHEL-50057, openCryptoki cca token RSA OAEP v2.1 support


author: Jan Černý <jcerny@redhat.com> - 1:1.3.11-1
changelog:
  - Upgrade to the latest upstream release (RHEL-76355)
  - Introduce "oscap-im", a tool for building hardened bootable container images
  - Fix RPM probes in bootable container images build environment (RHEL-55251)


author: Brian C. Lane <bcl@redhat.com> - 3.5-3
changelog:
  - tests: Add test for dvh with a bad checksum (bcl)
    Related: RHEL-73217
  - libparted: Fix dvh disklabel unhandled exception (bcl)
    Related: RHEL-73217
  - tests: Add test for SUN disklabel handling (bcl)
    Related: RHEL-73217
  - libparted: Fix sun disklabel unhandled exception (bcl)
    Resolves: RHEL-73217


author: Miro Hrončok <mhroncok@redhat.com> - 1.12.1-1
changelog:
  - Add a temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Related: rhbz#2284187


author: Miro Hrončok <mhroncok@redhat.com> - 1.13.0-1
changelog:
  - Properly escape weird characters from paths in %{pyproject_files} (RPM 4.19+ only)
  - Revert the temporary workaround for RPM 4.20 alpha 2 leaking \x1f (unit separators)
  - Fixes: rhbz#1990879


author: Python Maint <python-maint@redhat.com> - 1.15.0-1
changelog:
  - Add a possibility to read runtime requirements from pyproject.toml [project] table
  - Fixes: rhbz#2261939
  - Don't generate a dependency on pip when %pyproject_buildrequires -N is used
  - Fixes: rhbz#2294510
  - Even when %_auto_set_build_flags is disabled, set all compiler flags when building wheels
  - Fixes: rhbz#2293616


author: Miro Hrončok <mhroncok@redhat.com> - 1.16.0-1
changelog:
  - %pyproject_buildrequires: Add support for dependency groups (PEP 735), via the -g flag
  - This is implied when used tox testenvs depend on dependency groups (requires tox 4.22+)
  - Fixes: rhbz#2318849


author: Miro Hrončok <miro@hroncok.cz> - 1.16.1-1
changelog:
  - Support for setuptools 70+
  - wheel is no longer generated as a dependency of the default build system


author: Francisco Triviño <ftrivino@redhat.com> - 0.12.1-5
changelog:
  - Rebuilt needed for moving buildroot package to CRB
  - Resolves: RHEL-70463 python3-setuptools-rust is not signed
  - Resolves: RHEL-67341 move python3-setuptools-rust to CRB [rhel-9]


author: Francisco Triviño <ftrivino@redhat.com> - 0.12.1-6
changelog:
  - Rebuilt needed to trigger signing of the package
  - Resolves: RHEL-70463 python3-setuptools-rust is not signed


author: Vladis Dronov <vdronov@redhat.com> - 24.09.0-1
changelog:
  - Update to qatlib 24.09.0 @ 36fb0903 (RHEL-40255)
  - Add pciutils as a dependency of the qatlib-service subpackage
  - Add numactl-devel as a dependency since it is required by qatlib-24.09.0


author: Matej Matuska <mmatuska@redhat.com> - 0.18.0-4
changelog:
  - Bump leapp-framework to 6.0
  - Bump leapp-framework-dependencies to 6
  - Require python3-PyYAML
  - [Technical preview] Introduce configurability for leapp actors
  - Resolves: RHEL-57042


author: Petr Stodulka <pstodulk@redhat.com> - 0.19.0-1
changelog:
  - Rebase to new upstream version 0.19.0
  - Add possibility to use a specified execution context for snactor run in an existing leapp.db
  - Increase limits on the number of opened file descriptors and maximum size
    of manipulated files when running leapp
  - Resolves: RHEL-57042


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.5.9-1
changelog:
  - Rebase to upstream development version 2.5.9
  - Fix display of incorrect Windows 11 version
    resolves: RHEL-56784
  - Add customization options for post-conversion modification
    resolves: RHEL-55761
  - convert: windows: Ignore sriov drivers on virtio-win disk
    resolves: RHEL-56383


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-5
changelog:
  - Rebase to upstream development version 2.7.1
    resolves: RHEL-56813
  - Replace Jansson with json-c
    resolves: RHEL-65296
  - Find drivers for win2025 guests
    resolves: RHEL-65010
  - in-place: Add new -O option to write inspector XML
    resolves: RHEL-58032
  - mldrivers/linux_bootloaders.ml: Don't overwrite EFI grub2 wrapper
    resolves: RHEL-77989
  - convert: Use yum/apt/... for package removals
    resolves: RHEL-71522
  - Fix failure if the kernel-source package is installed in the source VM
    resolves: RHEL-80080


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79126), CVE-2025-26595 (RHEL-79130),
                 CVE-2025-26596 (RHEL-79134), CVE-2025-26597 (RHEL-79140),
                 CVE-2025-26598 (RHEL-79141), CVE-2025-26599 (RHEL-79146),
                 CVE-2025-26600 (RHEL-79154), CVE-2025-26601 (RHEL-79150)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-28
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-79125), CVE-2025-26595 (RHEL-79129),
                 CVE-2025-26596 (RHEL-79133), CVE-2025-26597 (RHEL-79137),
                 CVE-2025-26598 (RHEL-79138), CVE-2025-26599 (RHEL-79143),
                 CVE-2025-26600 (RHEL-79153), CVE-2025-26601 (RHEL-79149)


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-6
changelog:
  - Resolves: RHEL-86065 - Backport lib389 fixes required for WebUI [rhel-9.6.z]
  - Resolves: RHEL-80713 - Increased memory consumption caused by NDN cache [rhel-9.6.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-8
changelog:
  - Resolves: RHEL-83876 - CVE-2025-2487 389-ds-base: null pointer dereference leads to denial of service [rhel-9.6]


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-3
changelog:
  - Invalid memory access on Dnsconfd DBUS error (RHEL-84692)
  - Support IP configuration for secondary interfaces on Oracle VM from metadata (RHEL-84695)


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-16
changelog:
  - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-18
changelog:
  - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.13.1.el9_6]
changelog:
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83049]
  - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Maxim Levitsky) [RHEL-85942]
  - net: netvsc: Update default VMBus channels (Maxim Levitsky) [RHEL-85942]
  - net: mana: cleanup mana struct after debugfs_remove() (Maxim Levitsky) [RHEL-85942]
  - net: mana: Cleanup "mana" debugfs dir after cleanup of all children (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (Maxim Levitsky) [RHEL-85942]
  - net: mana: use ethtool string helpers (Maxim Levitsky) [RHEL-85942]
  - net: mana: Enable debugfs files for MANA device (Maxim Levitsky) [RHEL-85942]
  - net: mana: Add get_link and get_link_ksettings in ethtool (Maxim Levitsky) [RHEL-85942]
  - net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (Maxim Levitsky) [RHEL-85942]
  - net: mana: Improve mana_set_channels() in low mem conditions (Maxim Levitsky) [RHEL-85942]
  - net: mana: Implement get_ringparam/set_ringparam for mana (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (Maxim Levitsky) [RHEL-85942]
  - ice: Fix signedness bug in ice_init_interrupt_scheme() (Petr Oros) [RHEL-80557]
  - ice: init flow director before RDMA (Petr Oros) [RHEL-80557]
  - ice: simplify VF MSI-X managing (Petr Oros) [RHEL-80557]
  - ice: enable_rdma devlink param (Petr Oros) [RHEL-80557]
  - ice: treat dyn_allowed only as suggestion (Petr Oros) [RHEL-80557]
  - ice, irdma: move interrupts code to irdma (Petr Oros) [RHEL-80557]
  - ice: get rid of num_lan_msix field (Petr Oros) [RHEL-80557]
  - ice: remove splitting MSI-X between features (Petr Oros) [RHEL-80557]
  - ice: devlink PF MSI-X max and min parameter (Petr Oros) [RHEL-80557]
  - ice: ice_probe: init ice_adapter after HW init (Petr Oros) [RHEL-80557]
  - ice: minor: rename goto labels from err to unroll (Petr Oros) [RHEL-80557]
  - ice: split ice_init_hw() out from ice_init_dev() (Petr Oros) [RHEL-80557]
  - ice: c827: move wait for FW to ice_init_hw() (Petr Oros) [RHEL-80557]
  - smb: client: don't retry IO on failed negprotos with soft mounts (Jay Shin) [RHEL-85524]
  - cgroup: Remove steal time from usage_usec (Waiman Long) [RHEL-85398]
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CKI Backport Bot) [RHEL-85395] {CVE-2024-58069}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.14.1.el9_6]
changelog:
  - smb: client: fix regression with guest option (Paulo Alcantara) [RHEL-83859]
  - io_uring/sqpoll: zero sqd->thread on tctx errors (CKI Backport Bot) [RHEL-87264] {CVE-2025-21633}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Chris Leech) [RHEL-86915] {CVE-2025-21927}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CKI Backport Bot) [RHEL-86840] {CVE-2025-21993}
  - certs: Add ECDSA signature verification self-test (Herbert Xu) [RHEL-82247]
  - certs: Move RSA self-test data to separate file (Herbert Xu) [RHEL-82247]
  - certs: Break circular dependency when selftest is modular (Herbert Xu) [RHEL-82247]
  - KEYS: Include linux/errno.h in linux/verification.h (Herbert Xu) [RHEL-82247]
  - crypto: certs: fix FIPS selftest dependency (Herbert Xu) [RHEL-82247]
  - New configs in certs/Kconfig (Fedora Kernel Team) [RHEL-82247]
  - certs: Add support for using elliptic curve keys for signing modules (Herbert Xu) [RHEL-82247]
  - certs: Trigger creation of RSA module signing key if it's not an RSA key (Herbert Xu) [RHEL-82247]
  - tpm: Change to kvalloc() in eventlog/acpi.c (Štěpán Horáček) [RHEL-82147] {CVE-2024-58005}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.15.1.el9_6]
changelog:
  - ice: ensure periodic output start time is in the future (Petr Oros) [RHEL-86021]
  - ice: fix PHY Clock Recovery availability check (Petr Oros) [RHEL-86021]
  - ice: Drop auxbus use for PTP to finalize ice_adapter move (Petr Oros) [RHEL-86021]
  - ice: Use ice_adapter for PTP shared data instead of auxdev (Petr Oros) [RHEL-86021]
  - ice: Initial support for E825C hardware in ice_adapter (Petr Oros) [RHEL-86021]
  - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code (Petr Oros) [RHEL-86021]
  - ice: Introduce ice_get_phy_model() wrapper (Petr Oros) [RHEL-86021]
  - ice: Enable 1PPS out from CGU for E825C products (Petr Oros) [RHEL-86021]
  - ice: Read SDP section from NVM for pin definitions (Petr Oros) [RHEL-86021]
  - ice: Disable shared pin on E810 on setfunc (Petr Oros) [RHEL-86021]
  - ice: Cache perout/extts requests and check flags (Petr Oros) [RHEL-86021]
  - ice: Align E810T GPIO to other products (Petr Oros) [RHEL-86021]
  - ice: Add SDPs support for E825C (Petr Oros) [RHEL-86021]
  - ice: Implement ice_ptp_pin_desc (Petr Oros) [RHEL-86021]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.16.1.el9_6]
changelog:
  - soc: qcom: socinfo: Avoid out of bounds read of serial number (Jared Kangas) [RHEL-88252] {CVE-2024-58007}
  - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (Jared Kangas) [RHEL-88252]
  - soc: qcom: Add check devm_kasprintf() returned value (Jared Kangas) [RHEL-88252]


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.2.el9_6
changelog:
  - util: introduce object for holding a system inhibitor lock (RHEL-83076)
  - src: convert drivers over to new virInhibitor APIs (RHEL-83076)
  - rpc: remove logind support for virNetDaemon (RHEL-83076)
  - util: fix off-by-1 in inhibitor constants (RHEL-83076)
  - util: don't attempt to acquire logind inhibitor if not requested (RHEL-83076)
  - network: Free inhibitor in networkStateCleanup() (RHEL-83076)
  - conf: parse interface/source/@dev for all interface types (with backend type='passt') (RHEL-84689)
  - qemu: remove nonsensical sanity check in processNetdevStreamDisconnectedEvent() (RHEL-84782)
  - qemu: make processNetDevStreamDisconnectedEvent() reusable (RHEL-84782)
  - qemu: respond to NETDEV_VHOST_USER_DISCONNECTED event (RHEL-84782)
  - qemu: put vhost-user code that's special for passt in a helper function (RHEL-84782)
  - qemu: make passt+vhostuser reconnect behave identically to passt+user (RHEL-84782)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.3.el9_6
changelog:
  - Add load average information type into virDomainGetGuestInfo (RHEL-88449)
  - qemu_agent: Add qemuAgentGetLoadAvg() (RHEL-88449)
  - qemu: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88449)
  - virsh: Add support for VIR_DOMAIN_GUEST_INFO_LOAD (RHEL-88449)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.1
changelog:
  - Resolves: RHEL-84339 - nginx: Nginx: Specially crafted file may cause
    Denial of Service (CVE-2024-7347)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.2
changelog:
  - Resolves: RHEL-85550 - nginx: Memory disclosure in the
    ngx_http_mp4_module (CVE-2022-41742)
  - Resolves: RHEL-85527 - nginx: Memory corruption in the
    ngx_http_mp4_module (CVE-2022-41741)


author: Wen Liang <wenliang@redhat.com> - 2.2.43-1
changelog:
  - Upgrade to 2.2.43
  - Support ethtool Forward Error Correction (FEC). RHEL-80786
  - Support nm connection with empty connection.interface-name. RHEL-82662


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.17.1.el9_6]
changelog:
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Guillaume Nault) [RHEL-89646] {CVE-2025-37749}
  - cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add a remote partition transition test to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Clean up and restructure test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Code cleanup and comment update (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix race between newly created partition and dying one (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Make test_cpuset_prs.sh deal with pre-isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Account for boot time isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove use_parent_ecpus of cpuset (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove fetch_xcpus (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add new test cases to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove child_ecpus_count (Waiman Long) [RHEL-88640]
  - cpuset: use Union-Find to optimize the merging of cpumasks (Waiman Long) [RHEL-88640]
  - Union-Find: add a new module in kernel library (Waiman Long) [RHEL-88640]
  - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CKI Backport Bot) [RHEL-86899] {CVE-2025-21966}
  - ixgbe: fix media type detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbevf: Add support for Intel(R) E610 device (Corinna Vinschen) [RHEL-85809]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Corinna Vinschen) [RHEL-85809]
  - ixgbe: fix media cage present detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Enable link management in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Clean up the E610 link management related code (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for EEPROM dump in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for NVM handling in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add link management support for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 device capabilities detection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 FW Admin Command Interface (Corinna Vinschen) [RHEL-85809]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.18.1.el9_6]
changelog:
  - gitlab-ci: use rhel9.6 builder image (Michael Hofmann)
  - cifs: Fix integer overflow while processing acregmax mount option (CKI Backport Bot) [RHEL-87921] {CVE-2025-21964}
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (David Marlin) [RHEL-85647]
  - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in dsc helpers for slices, bpp (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_mode_valid_max_plane_size (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_dp_joiner_needs_dsc (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Simplify intel_joiner_num_pipes and its usage (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Check whether platform supports joiner (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation" (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode" (Jocelyn Falempe) [RHEL-85393]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.19.1.el9_6]
changelog:
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (David Arcari) [RHEL-87254] {CVE-2022-3424}
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89546] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen) [RHEL-84151]
  - page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen) [RHEL-84151]
  - ext4: fallback to complex scan if aligned scan doesn't work (Jay Shin) [RHEL-85984]
  - drm/mgag200: Added support for the new device G200eH5 (Jocelyn Falempe) [RHEL-88907]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.20.1.el9_6]
changelog:
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CKI Backport Bot) [RHEL-93253] {CVE-2025-37943}
  - ext4: fix OOB read when checking dotdot dir (CKI Backport Bot) [RHEL-87985] {CVE-2025-37785}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.21.1.el9_6]
changelog:
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (CKI Backport Bot) [RHEL-87911] {CVE-2025-21997}
  - vlan: enforce underlying device type (Guillaume Nault) [RHEL-87884] {CVE-2025-21920}
  - net: fix geneve_opt length integer overflow (Guillaume Nault) [RHEL-87974] {CVE-2025-22055}
  - net: gso: fix ownership in __udp_gso_segment (CKI Backport Bot) [RHEL-88333] {CVE-2025-21926}


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-9
changelog:
  - Reverts: RHEL-80713 - Increased memory consumption caused by NDN cache [rhel-9.6.z]
  - Resolves: RHEL-95443 - ns-slapd[xxxx]: segfault at 10d7d0d0 ip 00007ff734050cdb sp 00007ff6de9f1430 error 6 in libslapd.so.0.1.0[7ff733ec0000+1b3000] [rhel-9.6.z]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.22.1.el9_6]
changelog:
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Revert "SUNRPC: Revert e0a912e8ddba" (Benjamin Coddington) [RHEL-94811]
  - mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio (Jay Shin) [RHEL-92291]
  - mm: fix crashes from deferred split racing folio migration (Jay Shin) [RHEL-92291] {CVE-2024-42234}
  - mm: memcg: fix split queue list crash when large folio migration (Jay Shin) [RHEL-92291]
  - proc: fix UAF in proc_get_inode() (Ian Kent) [RHEL-86808] {CVE-2025-21999}
  - cifs: Fix integer overflow while processing acdirmax mount option (Paulo Alcantara) [RHEL-87941] {CVE-2025-21963}
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - eth: bnxt: fix truesize for mb-xdp-pass case (CKI Backport Bot) [RHEL-88328] {CVE-2025-21961}
  - vmxnet3: unregister xdp rxq info in the reset path (CKI Backport Bot) [RHEL-92471]
  - md: fix mddev uaf while iterating all_mddevs list (CKI Backport Bot) [RHEL-89062] {CVE-2025-22126}
  - nvme: print firmware bug note for non-unique identifiers (Bryan Gurney) [RHEL-91163]
  - nvme-pci: add BOGUS_NID quirk for Samsung PM1733 (Bryan Gurney) [RHEL-91163]
  - media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Use structures to describe bus configuration (Kate Hsuan) [RHEL-90323]
  - media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h (Kate Hsuan) [RHEL-90323]
  - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-86302]
  - smb: client: fix UAF in decryption with multichannel (CKI Backport Bot) [RHEL-94460] {CVE-2025-37750}


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-14.1
changelog:
  - Resolves: RHEL-89908
    EMBARGOED CVE-2025-4404 ipa: Privilege escalation from host to domain admin in FreeIPA
  - Resolves: RHEL-89144
    kdb: ipadb_get_connection() succeeds but returns null LDAP context


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.23.1.el9_6]
changelog:
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-94248] {CVE-2025-37738}
  - ibmvnic: Use kernel helpers for hex dumps (CKI Backport Bot) [RHEL-89019] {CVE-2025-22104}
  - ice: Avoid setting default Rx VSI twice in switchdev setup (Petr Oros) [RHEL-88310] {CVE-2025-21883}
  - ice: Fix deinitializing VF in error path (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - ice: add E830 HW VF mailbox message limit support (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-88322] {CVE-2025-21919}
  - redhat: configs: Enable CX231XX driver (Kate Hsuan) [RHEL-89730]
  - media: usb: usbtv: Stop direct calls to queue num_buffers field (Kate Hsuan) [RHEL-89730]
  - media: saa6752hs: Don't set format in sub-device state (Kate Hsuan) [RHEL-89730]
  - media: i2c: Use accessors for pad config 'try_*' fields (Kate Hsuan) [RHEL-89730]
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-93629] {CVE-2025-23150}


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97341), CVE-2025-49176 (RHEL-97335),
                 CVE-2025-49177 (RHEL-97358), CVE-2025-49178 (RHEL-97395),
                 CVE-2025-49179 (RHEL-97405), CVE-2025-49180 (RHEL-97245)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-30
changelog:
  - xfree86: Fix potentially NULL reference to platform device's PCI device
    Resolves: https://issues.redhat.com/browse/RHEL-88187


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97289), CVE-2025-49176 (RHEL-97311),
                 CVE-2025-49178 (RHEL-97388), CVE-2025-49179 (RHEL-97410),
                 CVE-2025-49180 (RHEL-97255)


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-35.1
changelog:
  - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch
  - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch
  - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch
  - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch
  - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch
  - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch
  - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch
  - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch
  - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch
  - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch
  - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch
  - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch
    * Fixes RHEL-80352 ("RFE: Enable multipathd to communicate with a
      process in another network namespace")
  - Resolves: RHEL-80352


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-10
changelog:
  - Resolves: RHEL-89735 - dsconf backend replication monitor fails if replica id starts with 0 [rhel-9.6.z]
  - Resolves: RHEL-89746 - ns-slapd crash in dbmdb_import_prepare_worker_entry() [rhel-9.6.z]
  - Resolves: RHEL-89752 - Nested group does not receive memberOf attribute [rhel-9.6.z]
  - Resolves: RHEL-89761 - dsidm Error: float() argument must be a string or a number, not 'NoneType' [rhel-9.6.z]
  - Resolves: RHEL-89768 - Crash in __strlen_sse2 when using the nsRole filter rewriter. [rhel-9.6.z]
  - Resolves: RHEL-89773 - Improve the "result" field of ipa-healthcheck if replicas are busy [rhel-9.6.z]
  - Resolves: RHEL-89781 - RHDS12.2 NSMMReplicationPlugin - release_replica Unable to parse the response [rhel-9.6.z]
  - Resolves: RHEL-95767 - Improve  error message when bulk import connection is closed [rhel-9.6.z]


author: Wen Liang <wenliang@redhat.com> - 1:1.52.0-4
changelog:
  - ovs: allow reapplying ovs-bridge and ovs-port properties (RHEL-87595)
  - core: ovs: fix NULL pointer dereference in ovsdb read timeout callback (RHEL-87347)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-22.3
changelog:
  - Resolves: RHEL-89991 - SSL-errors 0A000126 / NS_NET_ERROR_PARTIAL_TRANSFER at
    nginx with reverse-proxy


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.24.1.el9_6]
changelog:
  - Squashfs: fix handling and sanity checking of xattr_ids count (CKI Backport Bot) [RHEL-93465] {CVE-2023-52933}
  - net/mlx5: Fill out devlink dev info only for PFs (CKI Backport Bot) [RHEL-93770]
  - dm mpath: replace spin_lock_irqsave with spin_lock_irq (Benjamin Marzinski) [RHEL-89487]
  - dm-mpath: Don't grab work_mutex while probing paths (Benjamin Marzinski) [RHEL-89487]
  - dm mpath: Interface for explicit probing of active paths (Benjamin Marzinski) [RHEL-89487]
  - dm: Allow .prepare_ioctl to handle ioctls directly (Benjamin Marzinski) [RHEL-89487]
  - NFS: O_DIRECT writes must check and adjust the file length (Benjamin Coddington) [RHEL-96060]
  - pnfs/flexfiles: retry getting layout segment for reads (Benjamin Coddington) [RHEL-96060]
  - NFS/pnfs: Fix a live lock between recalled layouts and layoutget (Benjamin Coddington) [RHEL-96060]
  - x86/tsc: Use topology_max_packages() to get package number (David Arcari) [RHEL-96886]
  - scsi: storvsc: Explicitly set max_segment_size to UINT_MAX (Ewan D. Milne) [RHEL-97519]


author: Charalampos Stratakis <cstratak@redhat.com> - 3.9.21-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98053, RHEL-98025, RHEL-98243, RHEL-98195, RHEL-98219


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.11-2.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98045, RHEL-98015, RHEL-98238, RHEL-98177, RHEL-98206


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.9-1.1
changelog:
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  - Resolves: RHEL-98058, RHEL-98020, RHEL-97809, RHEL-98184, RHEL-98211


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.25.1.el9_6]
changelog:
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99124] {CVE-2022-49846}
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CKI Backport Bot) [RHEL-97110] {CVE-2025-37799}
  - NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew) [RHEL-95252]
  - ipv6: mcast: extend RCU protection in igmp6_send() (CKI Backport Bot) [RHEL-94673] {CVE-2025-21759}
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CKI Backport Bot) [RHEL-93445] {CVE-2025-21887}
  - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93132] {CVE-2025-22004}
  - block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone (Ming Lei) [RHEL-92268]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.26.1.el9_6]
changelog:
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98996] {CVE-2025-21991}
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (David Arcari) [RHEL-90212]
  - smb: client: fix perf regression with deferred closes (Paulo Alcantara) [RHEL-97482]
  - smb3 client: fix open hardlink on deferred close file error (Paulo Alcantara) [RHEL-97482]
  - Fix mmu notifiers for range-based invalidates (Jay Shin) [RHEL-93743]
  - vfio/pci: Align huge faults to order (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use mapping page mask for pfnmaps (Alex Williamson) [RHEL-88275]
  - mm: Provide address mask in struct follow_pfnmap_args (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use consistent types for page counts (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use vfio_batch for vaddr_get_pfns() (Alex Williamson) [RHEL-88275]
  - vfio/type1: Convert all vaddr_get_pfns() callers to use vfio_batch (Alex Williamson) [RHEL-88275]
  - vfio/type1: Catch zero from pin_user_pages_remote() (Alex Williamson) [RHEL-88275]
  - vfio/pci: Fallback huge faults for unaligned pfn (Donald Dutile) [RHEL-85623]
  - vfio/pci: implement huge_fault support (Donald Dutile) [RHEL-85623]
  - vfio/pci: Remove unused struct 'vfio_pci_mmap_vma' (Donald Dutile) [RHEL-85623]
  - vfio/pci: Insert full vma on mmap'd MMIO fault (Donald Dutile) [RHEL-85623]
  - vfio/pci: Use unmap_mapping_range() (Donald Dutile) [RHEL-85623]
  - mm/arm64: support large pfn mappings (Donald Dutile) [RHEL-85623]
  - mm/x86: support large pfn mappings (Donald Dutile) [RHEL-85623]
  - mm: remove follow_pte() (Donald Dutile) [RHEL-85623]
  - mm: follow_pte() improvements (Donald Dutile) [RHEL-85623]
  - mm/access_process_vm: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - vfio: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm/x86/pat: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - s390/pci_mmio: use follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - KVM: use follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm: pass VMA instead of MM to follow_pte() (Donald Dutile) [RHEL-85623]
  - mm: move follow_phys to arch/x86/mm/pat/memtype.c (Donald Dutile) [RHEL-85623]
  - mm: fix follow_pfnmap API lockdep assert (Donald Dutile) [RHEL-85623]
  - mm: new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm: remove follow_pfn (Donald Dutile) [RHEL-85623]
  - mm: always define pxx_pgprot() (Donald Dutile) [RHEL-85623]
  - mm/huge_memory: check pmd_special() only after pmd_present() (Donald Dutile) [RHEL-85623]
  - mm/fork: accept huge pfnmap entries (Donald Dutile) [RHEL-85623]
  - mm/pagewalk: check pfnmap for folio_walk_start() (Donald Dutile) [RHEL-85623]
  - mm/gup: detect huge pfnmap entries in gup-fast (Donald Dutile) [RHEL-85623]
  - mm: mark special bits for huge pfn mappings when inject (Donald Dutile) [RHEL-85623]
  - mm: drop is_huge_zero_pud() (Donald Dutile) [RHEL-85623]
  - mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud (Donald Dutile) [RHEL-85623]


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-16.2
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94290
  - Resolves: RHEL-102845


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.16.0.8-2
changelog:
  - Update to jdk-17.0.16+8
  - Add to .gitignore openjdk-17.0.16+8.tar.xz
  - Set updatever to 16
  - Set buildver to 8
  - Set rpmrelease to 2
  - Update sources to openjdk-17.0.16+8.tar.xz
  - Resolves: RHEL-101788
  - Resolves: RHEL-101795
  - Resolves: RHEL-101796
  - Resolves: RHEL-101797
  - Resolves: RHEL-102283
  - Resolves: RHEL-102286
  - Resolves: RHEL-102285
  - Resolves: RHEL-102284
  - Require tzdata-java 2025b at runtime and for build
  - Set bundled freetype provide version to 2.13.3
  - Set bundled harfbuzz provide version to 10.4.0
  - Set bundled lcms2 provide version to 2.17.0
  - Set bundled libpng provide version to 1.6.47
  - Recommend pipewire
  - Related: RHEL-102667
  - Resolves: RHEL-102669
  - Resolves: RHEL-102670
  - Resolves: RHEL-102672
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-1
changelog:
  - Update to jdk-21.0.7+6 (GA)
  - Update release notes to 21.0.7+6
  - Rebase FIPS support against 21.0.7+5
  - Require tzdata 2025a due to upstream inclusion of JDK-8347965
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-04-15 @ 1pm PT. **
  - Resolves: RHEL-86984
  - Resolves: RHEL-86635


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.7.0.6-2
changelog:
  - Add local version of JDK-8351500 for early interim release before 21.0.8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-90309


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update to jdk-21.0.8+1 (EA)
  - Update release notes to 21.0.8+1
  - Bump freetype version to 2.13.3 following JDK-8348596
  - Bump harfbuzz version to 10.4.0 following JDK-8348597
  - Bump lcms2 version to 2.17.0 following JDK-8348110
  - Bump libpng version to 1.6.47 following JDK-8348598
  - Switch to EA mode
  - Drop JDK-8351500 local patch which is now available in 21.0.8+1 upstream
  - Sync the copy of the portable specfile with the latest update
  - Related: RHEL-101798


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.1-0.1.ea
changelog:
  - Update get_bundle_versions.sh to match other scripts
  - * get_bundle_versions.sh: Add license
  - * get_bundle_versions.sh: Set compile-command in Emacs
  - * get_bundle_versions.sh: Use different error codes for different failures
  - * get_bundle_versions.sh: Remove unneeded '.' in JPEG version
  - * get_bundle_versions.sh: shellcheck: Double-quote variable references (SC2086)
  - * get_bundle_versions.sh: shellcheck: Drop use of cat and pass file to awk directly (SC2002)
  - Add OpenJDK 8u support to get_bundle_versions.sh
  - Print bundle updates and backouts at end of openjdk_news.sh output
  - Refer user to get_bundle_versions.sh when bundle updates are found by openjdk_news.sh
  - Related: RHEL-103209


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.2-0.1.ea
changelog:
  - Update to jdk-21.0.8+2 (EA)
  - Update release notes to 21.0.8+2
  - Sync the copy of the portable specfile with the latest update
  - Add timezone data update check to openjdk_news.sh
  - Add duplicate check to openjdk_news.sh
  - Exit if no fixes are obtained rather than try to run filters in openjdk_news.sh
  - Related: RHEL-101798
  - Resolves: RHEL-103209


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.8-0.1.ea
changelog:
  - Update to jdk-21.0.8+8 (EA)
  - Update release notes to 21.0.8+8
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-101798


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:21.0.7.0.6-3
changelog:
  - Recommend PipeWire on RHEL 9 and later for java.awt.Robot screenshots under Wayland
  - Resolves: RHEL-102677


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.8.0.9-1.1
changelog:
  - Update to jdk-21.0.8+9 (GA)
  - Update release notes to 21.0.8+9
  - Switch to GA mode
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-102289


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.462.b08-1
changelog:
  - Update to 8u462-b08 (GA)
  - Update release notes for 8u462-b08.
  - Require tzdata 2025b due to upstream inclusion of JDK-8352716
  - Add early backport of JDK-8339414
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2025-07-15 @ 1pm PT. **
  - Resolves: RHEL-101657
  - Resolves: RHEL-102311
  - Resolves: RHEL-102910


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.27.1.el9_6]
changelog:
  - i2c: tegra: check msg length in SMBUS block read (Steve Dunnagan) [RHEL-100516]
  - net/mlx5: Generate PPS IN event on new function for shared clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Support one PTP device per hardware clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add devcom component for the clock shared by functions (Michal Schmidt) [RHEL-87775]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Michal Schmidt) [RHEL-87775]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add init and destruction functions for a single HW clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Change parameters for PTP internal functions (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add helper functions for PTP callbacks (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add support for MRTCQ register (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: use do_aux_work for PHC overflow checks (Michal Schmidt) [RHEL-87775]
  - mlx5_en: use read sequence for gettimex64 (Benjamin Poirier) [RHEL-87775]
  - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98772] {CVE-2024-58002}
  - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98772]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.28.1.el9_6]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CKI Backport Bot) [RHEL-101327] {CVE-2025-38089}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.29.1.el9_6]
changelog:
  - tcp: adjust rcvq_space after updating scaling ratio (Guillaume Nault) [RHEL-99145]
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
  - ext4: introduce ITAIL helper (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
  - ext4: avoid journaling sb update on error if journal is destroying (Brian Foster) [RHEL-93591] {CVE-2025-22113}
  - ext4: define ext4_journal_destroy wrapper (Brian Foster) [RHEL-93591]
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CKI Backport Bot) [RHEL-102093] {CVE-2025-38110}
  - smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [RHEL-101953]
  - redhat/configs: remove automotive directory (Eric Chanudet) [RHEL-96365]
  - r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (CKI Backport Bot) [RHEL-96715]
  - r8169: disable RTL8126 ZRX-DC timeout (CKI Backport Bot) [RHEL-96715]
  - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101212] {CVE-2025-38086}
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98795] {CVE-2024-57980}
  - RDMA/mlx5: Fix page_size variable overflow (CKI Backport Bot) [RHEL-99320] {CVE-2025-22091}
  - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99384] {CVE-2025-21905}
  - RDMA/core: Fix use-after-free when rename device name (CKI Backport Bot) [RHEL-99048] {CVE-2025-22085}
  - octeon_ep: Fix host hang issue during device reboot (CKI Backport Bot) [RHEL-93251]
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Rafael Aquini) [RHEL-96368] {CVE-2025-37958}
  - octeon_ep_vf: Resolve netdevice usage count issue (CKI Backport Bot) [RHEL-93252]
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (CKI Backport Bot) [RHEL-87555]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.30.1.el9_6]
changelog:
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Davide Caratti) [RHEL-95853] {CVE-2025-37797}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.31.1.el9_6]
changelog:
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (David Marlin) [RHEL-95324] {CVE-2025-37918}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Desnes Nunes) [RHEL-99029] {CVE-2025-22020}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (John W. Linville) [RHEL-97499] {CVE-2022-49788}
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103087]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103087] {CVE-2025-38052}
  - md/raid1: Add check for missing source disk in process_checks() (CKI Backport Bot) [RHEL-97439]
  - net/sched: fix use-after-free in taprio_dev_notifier (CKI Backport Bot) [RHEL-101317] {CVE-2025-38087}
  - padata: avoid UAF for reorder_work (Rafael Aquini) [RHEL-97031] {CVE-2025-21727 CVE-2025-21726}
  - padata: fix UAF in padata_reorder (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: add pd get/put refcnt helper (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: fix sysfs store callback check (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: Clean up in padata_do_multithreaded() (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - platform/x86: dell_rbu: Fix list usage (David Arcari) [RHEL-100908]
  - cifs: Fix integer overflow while processing closetimeo mount option (CKI Backport Bot) [RHEL-87900] {CVE-2025-21962}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.32.1.el9_6]
changelog:
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Davide Caratti) [RHEL-97522] {CVE-2025-38001 CVE-2025-37890}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Davide Caratti) [RHEL-97522] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Davide Caratti) [RHEL-97522] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Ivan Vecera) [RHEL-97522]
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98847] {CVE-2025-21928}
  - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CKI Backport Bot) [RHEL-98871] {CVE-2025-21929}


author: Jon Maloy <jmaloy@redhat.com> - 2.7.0.6-11.el9_6.1
changelog:
  - wla-redhat-Include-10-azure-unmanaged-sriov.rules-into-i.patch [RHEL-88808]
  - Resolves: RHEL-88808
    ([Azure][ARM][RHEL-9] Kdump cannot save vmcore via ssh or nfs [rhel-9.6.z])


author: Joan Torres <joantolo@redhat.com> - 40.1-29
changelog:
  - Fix legacy-xorg session switching
    The fix that intended to fix the issue wasn't complete and also,
    introduced a bug on user switching for non legacy-xorg servers.
    This fix addresses both issues.
  - Avoid waiting 10s when starting GDM in legacy-xorg mode
    Resolves: RHEL-97492


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.4.el9_6
changelog:
  - qemuMonitorJSONGetCPUModelExpansion: refactor parsing functions (RHEL-89977)
  - qemu: parse deprecated-props from query-cpu-model-expansion response (RHEL-89977)
  - qemu_capabilities: query deprecated features for host-model (RHEL-89977)
  - libvirt-domain: introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_DISABLE_DEPRECATED_FEATURES (RHEL-89977)
  - qemu_capabilities: filter deprecated features if requested (RHEL-89977)
  - virsh: add --disable-deprecated-features flag to domcapabilities (RHEL-89977)
  - conf: add deprecated_features attribute (RHEL-89977)


author: Tomas Pelka <tpelka@redhat.com> - 40.9-25
changelog:
  - Bumping the release and rebuilding in correct build target
  - Backport fix for screen not refreshing properly
    Resolves: RHEL-101894


author: Gris Ge <fge@redhat.com> - 2.2.46-1
changelog:
  - Upgrade to 2.2.46
  - Store DNS to both iface and global DNS. RHEL-96176
  - Support nmpolicy against down iface. RHEL-88992
  - Support removal VLAN connection with empty ifname. RHEL-93145


author: Gris Ge <fge@redhat.com> - 2.2.48-1
changelog:
  - Upgrade to 2.2.48
  - Fix SRIOV VF reference. RHEL-93179
  - Apply dispatch changes first. RHEL-101741


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.33.1.el9_6]
changelog:
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - redhat: update BUILD_TARGET to rhel-9.6.0-z-test-pesign (Jan Stancek)
  - PCI: Use downstream bridges for distributing resources (Jennifer Berringer) [RHEL-102666]
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Charles Mirabile) [RHEL-102652]
  - PCI: Fix pci_enable_acs() support for the ACS quirks (Charles Mirabile) [RHEL-102652]
  - Documentation: Fix pci=config_acs= example (Charles Mirabile) [RHEL-102652]
  - Revert "PCI: Wait for device readiness with Configuration RRS" (John W. Linville) [RHEL-94414]
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (CKI Backport Bot) [RHEL-82564]
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (CKI Backport Bot) [RHEL-82564]
  - wifi: ath12k: fix invalid access to memory (CKI Backport Bot) [RHEL-103219] {CVE-2025-38292}
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102235] {CVE-2025-38079}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.33.2.el9_6]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Patrick Talbert) [RHEL-108138]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.34.1.el9_6]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106625] {CVE-2025-38380}
  - tls: always refresh the queue when reading sock (CKI Backport Bot) [RHEL-106081] {CVE-2025-38471}
  - net: fix udp gso skb_segment after pull from frag_list (Guillaume Nault) [RHEL-103028] {CVE-2025-38124}
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101246] {CVE-2025-38085}
  - mm/hugetlb: unshare page tables during VMA split, not before (Rafael Aquini) [RHEL-101282] {CVE-2025-38084}
  - mm: fix copy_vma() error handling for hugetlb mappings (Rafael Aquini) [RHEL-101282]
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CKI Backport Bot) [RHEL-103256] {CVE-2025-38250}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.35.1.el9_6]
changelog:
  - s390/dasd: Remove DMA alignment (CKI Backport Bot) [RHEL-91593]
  - s390/cpumf: Update CPU Measurement facility extended counter set support (CKI Backport Bot) [RHEL-103066]
  - s390/topology: Improve topology detection (CKI Backport Bot) [RHEL-92100]
  - s390/pai: export number of sysfs attribute files (CKI Backport Bot) [RHEL-87178]
  - s390/pai: fix attr_event_free upper limit for pai device drivers (CKI Backport Bot) [RHEL-87178]
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity (Mamatha Inamdar) [RHEL-92081]
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103151] {CVE-2025-38159}
  - redhat: Mark kernel incompatible with xdp-tools<1.5.4 (Felix Maurer) [RHEL-101008]
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CKI Backport Bot) [RHEL-101008] {CVE-2025-21867}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-100603]
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-100603] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-100603] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-100603]
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-100603]
  - arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-100603]
  - redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-100603]
  - selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Waiman Long) [RHEL-100603]
  - x86/bpf: Add IBHF call at end of classic BPF (Waiman Long) [RHEL-100603]
  - x86/bpf: Call branch history clearing sequence on exit (Waiman Long) [RHEL-100603]
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-100603]
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-100603]
  - x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-100603]
  - x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-100603]
  - x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-100603]
  - x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-100603]
  - selftests: Warn about skipped tests in result summary (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix typo in x86_match_cpu()'s doc (Waiman Long) [RHEL-100603]
  - x86/cpu: Expose only stepping min/max interface (Waiman Long) [RHEL-100603]
  - x86/cpu: Add CPU type to struct cpuinfo_topology (Waiman Long) [RHEL-100603]
  - x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES (Waiman Long) [RHEL-100603]
  - x86/cpufeatures: Rename X86_FEATURE_FAST_CPPC to have AMD prefix (Waiman Long) [RHEL-100603]
  - tools/include: Sync x86 headers with the kernel sources (Waiman Long) [RHEL-100603]
  - selftests: ksft: Fix finished() helper exit code on skipped tests (Waiman Long) [RHEL-100603]
  - kselftest: Move ksft helper module to common directory (Waiman Long) [RHEL-100603]
  - platform/x86/intel/ifs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/platform/atom: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - cpufreq: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/bugs: Add 'spectre_bhi=vmexit' cmdline option (Waiman Long) [RHEL-100603]
  - EDAC/skx: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - EDAC/i10nm: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL (Waiman Long) [RHEL-100603]
  - x86/aperfmperf: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/apic: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/bugs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - EDAC/i10nm: Add Intel Grand Ridge micro-server support (Waiman Long) [RHEL-100603]
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Patrick Talbert) [RHEL-108138]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.36.1.el9_6]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104091] {CVE-2025-22058}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-104719] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Ivan Vecera) [RHEL-104719]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.37.1.el9_6]
changelog:
  - ice: fix eswitch code memory leak in reset scenario (CKI Backport Bot) [RHEL-108152] {CVE-2025-38417}
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-105151]
  - ethtool: Fix set RXNFC command with symmetric RSS hash (Mohammad Heib) [RHEL-103526]
  - drm/i915: Give i915 and xe each their own display tracepoints (Jocelyn Falempe) [RHEL-94419]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.38.1.el9_6]
changelog:
  - net/sched: ets: use old 'nbands' while purging unused classes (CKI Backport Bot) [RHEL-107537] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107537] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93387] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-37932}
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-107630] {CVE-2025-37823}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CKI Backport Bot) [RHEL-106046] {CVE-2025-38200}
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-106003] {CVE-2025-38461}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CKI Backport Bot) [RHEL-104273] {CVE-2025-38211}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.39.1.el9_6]
changelog:
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot) [RHEL-109529] {CVE-2025-38500}
  - Merge: net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response [rhel-9.6.z] (Maxim Levitsky) [RHEL-58904]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-102036]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-102036]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-102036]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-102036]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Thomas Huth) [RHEL-102036] {CVE-2025-37946}
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-102036] {CVE-2025-37974}
  - s390/pci: Fix potential double remove of hotplug slot (Thomas Huth) [RHEL-102036] {CVE-2024-56699}
  - s390/pci: remove hotplug slot when releasing the device (Thomas Huth) [RHEL-102036]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Thomas Huth) [RHEL-102036]
  - s390/pci: rename lock member in struct zpci_dev (Thomas Huth) [RHEL-102036]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107895]
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen) [RHEL-105137]
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-94815]
  - s390/pci: Fix handling of isolated VFs (CKI Backport Bot) [RHEL-85387]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (CKI Backport Bot) [RHEL-85387]
  - s390/pci: Fix SR-IOV for PFs initially in standby (CKI Backport Bot) [RHEL-85387]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106651] {CVE-2025-38464}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-106415] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-106415]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-106415]
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103555]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.41.1.el9_6]
changelog:
  - powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Mamatha Inamdar) [RHEL-107002]
  - net: ibmveth: make veth_pool_store stop hanging (Mamatha Inamdar) [RHEL-109494]
  - ibmveth: Always stop tx queues during close (Mamatha Inamdar) [RHEL-109494]
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-109723]
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-109723]
  - smb: convert to ctime accessor functions (Paulo Alcantara) [RHEL-109723]
  - crypto: tegra - Fix IV usage for AES ECB (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix format specifier in tegra_sha_prep_cmd() (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Use HMAC fallback when keyslots are full (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Reserve keyslots to allocate dynamically (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix CMAC intermediate result handling (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix HASH intermediate result handling (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Transfer HASH init function to crypto engine (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - check return value for hash do_one_req (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - finalize crypto req on error (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Do not use fixed size buffers (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Use separate buffer for setkey (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - remove unneeded crypto_engine_stop() call (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - remove redundant error check on ret (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - do not transfer req when tegra init fails (Nirmala Dalvi) [RHEL-107286]
  - crypto: engine - Remove prepare/unprepare request (Nirmala Dalvi) [RHEL-107286]
  - udmabuf: fix a buf size overflow issue during udmabuf creation (CKI Backport Bot) [RHEL-99746] {CVE-2025-37803}


author: Viktor Ashirov <vashirov@redhat.com> - 2.6.1-11
changelog:
  - Resolves: RHEL-18333 - Can't rename users member of automember rule [rhel-9.6.z]
  - Resolves: RHEL-81140 - Healthcheck tool should warn admin about creating a substring index on membership attribute [rhel-9.6.z]
  - Resolves: RHEL-92052 - Memory leak in roles_cache_create_object_from_entry [rhel-9.6.z]
  - Resolves: RHEL-95384 - Getting error messages while migration to LMDB.
  - Resolves: RHEL-106582 - Failure to gather database statistics with LMDB.
  - Resolves: RHEL-106793 - LDAP healthcheck complains about needed parameters when using LMDB.
  - Resolves: RHEL-107004 - Failure to get Server monitoring data when NDN cache is disabled. [rhel-9.6.z]
  - Resolves: RHEL-109033 - Allow Uniqueness plugin to search uniqueness attributes using custom matching rules [rhel-9.6.z]
  - Resolves: RHEL-109884 - Wrong backend database name syntax causes "Red Hat Directory Server" => "Databases" menu blank in Cockpit [rhel-9.6.z]
  - Resolves: RHEL-109888 - RootDN Access Control Plugin with wildcards for IP addresses fails with an error "Invalid IP address" [rhel-9.6.z]
  - Resolves: RHEL-109891 - On RHDS 12.6 The user password policy for a user was created, but the pwdpolicysubentry attribute for this user incorrectly points to the People OU password policy instead of the specific user policy.  [rhel-9.6.z]
  - Resolves: RHEL-109896 - AddressSanitizer: leak in do_search [rhel-9.6.z]
  - Resolves: RHEL-109904 - ns-slapd crashed when we add nsslapd-referral [rhel-9.6.z]
  - Resolves: RHEL-109945 - CWE-284 dirsrv log rotation creates files with world readable permission [rhel-9.6.z]
  - Resolves: RHEL-109954 - CWE-532 Created user password hash available to see in audit log [rhel-9.6.z]
  - Resolves: RHEL-109957 - CWE-778 Log doesn't show what user gets password changed by administrator [rhel-9.6.z]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.42.1.el9_6]
changelog:
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Mamatha Inamdar) [RHEL-103015]
  - drm/framebuffer: Acquire internal references on GEM handles (José Expósito) [RHEL-106699] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (José Expósito) [RHEL-106699] {CVE-2025-38449}
  - drm/vkms: Fix use after free and double free on init error (CKI KWF BOT) [RHEL-99420] {CVE-2025-22097}
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105933] {CVE-2025-38332}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.42.2.el9_6]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112780] {CVE-2025-38352}
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (CKI Backport Bot) [RHEL-113173]


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.21.3-12
changelog:
  - resolves: RHEL-101766 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.21.3-7)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.43.1.el9_6]
changelog:
  - eth: bnxt: fix missing ring index trim on error path (CKI Backport Bot) [RHEL-104561] {CVE-2025-37873}
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Mamatha Inamdar) [RHEL-109492]
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Mamatha Inamdar) [RHEL-109492]
  - net: introduce per netns packet chains (Paolo Abeni) [RHEL-89050]
  - enic: fix incorrect MTU comparison in enic_change_mtu() (John Meneghini) [RHEL-108274]
  - net/enic: Allow at least 8 RQs to always be used (John Meneghini) [RHEL-108274]
  - enic: get max rq & wq entries supported by hw, 16K queues (John Meneghini) [RHEL-106604]
  - enic: cleanup of enic wq request completion path (John Meneghini) [RHEL-106604]
  - enic: added enic_wq.c and enic_wq.h (John Meneghini) [RHEL-106604]
  - enic: remove unused function cq_enet_wq_desc_dec (John Meneghini) [RHEL-106604]
  - enic: enable rq extended cq support (John Meneghini) [RHEL-106604]
  - enic: enic rq extended cq defines (John Meneghini) [RHEL-106604]
  - enic: enic rq code reorg (John Meneghini) [RHEL-106604]
  - enic: Move function from header file to c file (John Meneghini) [RHEL-106604]
  - enic: add dependency on Page Pool (John Meneghini) [RHEL-106604]
  - enic: remove copybreak tunable (John Meneghini) [RHEL-106604]
  - enic: Use the Page Pool API for RX (John Meneghini) [RHEL-106604]
  - enic: Simplify RX handler function (John Meneghini) [RHEL-106604]
  - enic: Move RX functions to their own file (John Meneghini) [RHEL-106604]
  - enic: Fix typo in comment in table indexed by link speed (John Meneghini) [RHEL-106604]
  - enic: Obtain the Link speed only after the link comes up (John Meneghini) [RHEL-106604]
  - enic: Move RX coalescing set function (John Meneghini) [RHEL-106604]
  - enic: Move kdump check into enic_adjust_resources() (John Meneghini) [RHEL-106604]
  - enic: Move enic resource adjustments to separate function (John Meneghini) [RHEL-106604]
  - enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (John Meneghini) [RHEL-106604]
  - enic: Allocate arrays in enic struct based on VIC config (John Meneghini) [RHEL-106604]
  - enic: Save resource counts we read from HW (John Meneghini) [RHEL-106604]
  - enic: Make MSI-X I/O interrupts come after the other required ones (John Meneghini) [RHEL-106604]
  - enic: Create enic_wq/rq structures to bundle per wq/rq data (John Meneghini) [RHEL-106604]
  - enic: Report some per queue statistics in ethtool (John Meneghini) [RHEL-106604]
  - enic: Report per queue statistics in netdev qstats (John Meneghini) [RHEL-106604]
  - enic: Collect per queue statistics (John Meneghini) [RHEL-106604]
  - enic: Use macro instead of static const variables for array sizes (John Meneghini) [RHEL-106604]
  - enic: add ethtool get_channel support (John Meneghini) [RHEL-106604]
  - enic: Validate length of nl attributes in enic_set_vf_port (John Meneghini) [RHEL-106604]
  - enic: Replace hardcoded values for vnic descriptor by defines (John Meneghini) [RHEL-106604]
  - enic: Avoid false positive under FORTIFY_SOURCE (John Meneghini) [RHEL-106604]
  - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (John Meneghini) [RHEL-106420]
  - scsi: fnic: Set appropriate logging level for log message (John Meneghini) [RHEL-106420]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (John Meneghini) [RHEL-106420]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (John Meneghini) [RHEL-106420]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (John Meneghini) [RHEL-106420]
  - scsi: fnic: Remove unnecessary NUL-terminations (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove redundant flush_workqueue() calls (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary spinlock locking and unlocking (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace fnic->lock_flags with local flags (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace use of sizeof with standard usage (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix indentation and remove unnecessary parenthesis (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary debug print (John Meneghini) [RHEL-106419]
  - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Test for memory allocation failure and return error code (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return appropriate error code from failure of scsi drv init (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return appropriate error code for mem alloc failure (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix use of uninitialized value in debug message (John Meneghini) [RHEL-106419]
  - scsi: fnic: Delete incorrect debugfs error handling (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove extern definition from .c files (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support to handle port channel RSCN (John Meneghini) [RHEL-106419]
  - scsi: fnic: Code cleanup (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add stats and related functionality (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify fnic interfaces to use FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify IO path to use FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add functionality in fnic to support FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and integrate support for FIP (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and integrate support for FDMI (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add Cisco hardware model names (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for unsolicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for target based solicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for fabric based solicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add headers and definitions for FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vcalloc() instead of vmalloc() and memset(0) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Move flush_work initialization out of if block (John Meneghini) [RHEL-106419]
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue (John Meneghini) [RHEL-106419]
  - scsi: fnic: Convert snprintf() to sysfs_emit() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Clean up some inconsistent indenting (John Meneghini) [RHEL-106419]
  - scsi: fnic: unlock on error path in fnic_queuecommand() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-106419]
  - scsi: fnic: Improve logs and add support for multiqueue (MQ) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for multiqueue (MQ) in fnic driver (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for multiqueue (MQ) in fnic_main.c (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove usage of host_lock (John Meneghini) [RHEL-106419]
  - scsi: fnic: Define stats to track multiqueue (MQ) IOs (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify ISRs to support multiqueue (MQ) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Refactor and redefine fnic.h for multiqueue (John Meneghini) [RHEL-106419]
  - scsi: fnic: Get copy workqueue count and interrupt mode from config (John Meneghini) [RHEL-106419]
  - scsi: fnic: Rename wq_copy to hw_copy_wq (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and improve log messages (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and use fnic number (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify definitions to sync with VIC firmware (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return error if vmalloc() failed (John Meneghini) [RHEL-106419]
  - scsi: fnic: Clean up some inconsistent indenting (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix sg_reset success path (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unused functions fnic_scsi_host_start/end_tag() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace sgreset tag with max_tag_id (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vmalloc_array() and vcalloc() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vzalloc() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Refactor code in fnic probe to initialize SCSI layer (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace DMA mask of 64 bits with 47 bits (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unneeded flush_workqueue() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove redundant NULL check (John Meneghini) [RHEL-106419]
  - scsi: fnic: Stop using the SCSI pointer (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix a tracing statement (John Meneghini) [RHEL-106419]
  - scsi: fnic: Call scsi_done() directly (John Meneghini) [RHEL-106419]
  - Revert "driver core: Fix uevent_show() vs driver detach race" (Mark Langsdorf) [RHEL-85410]


author: Chao YE <cye@redhat.com> [5.14.0-570.44.1.el9_6]
changelog:
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CKI Backport Bot) [RHEL-111149] {CVE-2025-38550}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112780] {CVE-2025-38352}
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (CKI Backport Bot) [RHEL-113173]


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.19.3-6
changelog:
  - Add support for the Wacom Intuos Pro (RHEL-105483)
  - Rename existing patches for better order clarity


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-4
changelog:
  - Add support for the Cintiq Pro 27 (RHEL-101886)
  - Add support for the Intuos Pro 3rd Gen series (RHEL-101881)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-5
changelog:
  - Rearrange the OSD buttons for the Intuos Pro 3rd Gen (RHEL-101881)
  - Use separate Ring/Ring2 assignments


author: Anusha Srivatsa <asrivats@redhat.com> - 24.2.8-3
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-107885


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.2-2
changelog:
  - Backport https://github.com/ostreedev/ostree/pull/3472
    Backport https://github.com/ostreedev/ostree/pull/3473
    Resolves: #RHEL-108923


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.51.7-2
changelog:
  - Remove the build argument -flto-partition to avoid compilation crashes due
    to high memory usage.


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.52.0-6
changelog:
  - ovs: only keep bridges and ports with NM interfaces attached (RHEL-87167)
  - device: update the external-down unmanaged flag on port attach/release (RHEL-93183)
  - ovs: set the tun interface up before stage3 (RHEL-98550)
  - bridge: fix reapplying port VLANs (RHEL-102742)
  - device: don't disable IPv6 in stage3 on reapply (RHEL-102771)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-7.7.el9_6
changelog:
  - qemu: fix order of VNC TLS config entries (RHEL-106277)
  - qemu: sanitize blank lines in config file (RHEL-106277)
  - qemu: add ability to set TLS priority string with QEMU (RHEL-106277)
  - qemuxmlconftest: Include shared memory 'net-vhostuser' test cases (RHEL-106504)
  - qemuValidateDomainDeviceDefNetwork: Require shared memory for all vhost-user interfaces (RHEL-106504)
  - qemu: process: Remove un-updated 'qemuProcessStartWarnShmem' (RHEL-106504)


