# changelog

author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.10.1.el9_6]
changelog:
  - redhat: drop Y issues from changelog (Jan Stancek)
  - Reapply "perf util: Make util its own library" (Michael Petlan) [RHEL-79032]
  - iommu/vt-d: Fix suspicious RCU usage (Jerry Snitselaar) [RHEL-70102]
  - iommu/vt-d: Remove device comparison in context_setup_pass_through_cb (Jerry Snitselaar) [RHEL-70102]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.13.1.el9_6]
changelog:
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83049]
  - hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event (Maxim Levitsky) [RHEL-85942]
  - net: netvsc: Update default VMBus channels (Maxim Levitsky) [RHEL-85942]
  - net: mana: cleanup mana struct after debugfs_remove() (Maxim Levitsky) [RHEL-85942]
  - net: mana: Cleanup "mana" debugfs dir after cleanup of all children (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix irq_contexts memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix memory leak in mana_gd_setup_irqs (Maxim Levitsky) [RHEL-85942]
  - net :mana :Request a V2 response version for MANA_QUERY_GF_STAT (Maxim Levitsky) [RHEL-85942]
  - net: mana: use ethtool string helpers (Maxim Levitsky) [RHEL-85942]
  - net: mana: Enable debugfs files for MANA device (Maxim Levitsky) [RHEL-85942]
  - net: mana: Add get_link and get_link_ksettings in ethtool (Maxim Levitsky) [RHEL-85942]
  - net: mana: Increase the DEF_RX_BUFFERS_PER_QUEUE to 1024 (Maxim Levitsky) [RHEL-85942]
  - net: mana: Improve mana_set_channels() in low mem conditions (Maxim Levitsky) [RHEL-85942]
  - net: mana: Implement get_ringparam/set_ringparam for mana (Maxim Levitsky) [RHEL-85942]
  - net: mana: Fix error handling in mana_create_txq/rxq's NAPI cleanup (Maxim Levitsky) [RHEL-85942]
  - ice: Fix signedness bug in ice_init_interrupt_scheme() (Petr Oros) [RHEL-80557]
  - ice: init flow director before RDMA (Petr Oros) [RHEL-80557]
  - ice: simplify VF MSI-X managing (Petr Oros) [RHEL-80557]
  - ice: enable_rdma devlink param (Petr Oros) [RHEL-80557]
  - ice: treat dyn_allowed only as suggestion (Petr Oros) [RHEL-80557]
  - ice, irdma: move interrupts code to irdma (Petr Oros) [RHEL-80557]
  - ice: get rid of num_lan_msix field (Petr Oros) [RHEL-80557]
  - ice: remove splitting MSI-X between features (Petr Oros) [RHEL-80557]
  - ice: devlink PF MSI-X max and min parameter (Petr Oros) [RHEL-80557]
  - ice: ice_probe: init ice_adapter after HW init (Petr Oros) [RHEL-80557]
  - ice: minor: rename goto labels from err to unroll (Petr Oros) [RHEL-80557]
  - ice: split ice_init_hw() out from ice_init_dev() (Petr Oros) [RHEL-80557]
  - ice: c827: move wait for FW to ice_init_hw() (Petr Oros) [RHEL-80557]
  - smb: client: don't retry IO on failed negprotos with soft mounts (Jay Shin) [RHEL-85524]
  - cgroup: Remove steal time from usage_usec (Waiman Long) [RHEL-85398]
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read (CKI Backport Bot) [RHEL-85395] {CVE-2024-58069}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.14.1.el9_6]
changelog:
  - smb: client: fix regression with guest option (Paulo Alcantara) [RHEL-83859]
  - io_uring/sqpoll: zero sqd->thread on tctx errors (CKI Backport Bot) [RHEL-87264] {CVE-2025-21633}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() (Chris Leech) [RHEL-86915] {CVE-2025-21927}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() (CKI Backport Bot) [RHEL-86840] {CVE-2025-21993}
  - certs: Add ECDSA signature verification self-test (Herbert Xu) [RHEL-82247]
  - certs: Move RSA self-test data to separate file (Herbert Xu) [RHEL-82247]
  - certs: Break circular dependency when selftest is modular (Herbert Xu) [RHEL-82247]
  - KEYS: Include linux/errno.h in linux/verification.h (Herbert Xu) [RHEL-82247]
  - crypto: certs: fix FIPS selftest dependency (Herbert Xu) [RHEL-82247]
  - New configs in certs/Kconfig (Fedora Kernel Team) [RHEL-82247]
  - certs: Add support for using elliptic curve keys for signing modules (Herbert Xu) [RHEL-82247]
  - certs: Trigger creation of RSA module signing key if it's not an RSA key (Herbert Xu) [RHEL-82247]
  - tpm: Change to kvalloc() in eventlog/acpi.c (Štěpán Horáček) [RHEL-82147] {CVE-2024-58005}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.15.1.el9_6]
changelog:
  - ice: ensure periodic output start time is in the future (Petr Oros) [RHEL-86021]
  - ice: fix PHY Clock Recovery availability check (Petr Oros) [RHEL-86021]
  - ice: Drop auxbus use for PTP to finalize ice_adapter move (Petr Oros) [RHEL-86021]
  - ice: Use ice_adapter for PTP shared data instead of auxdev (Petr Oros) [RHEL-86021]
  - ice: Initial support for E825C hardware in ice_adapter (Petr Oros) [RHEL-86021]
  - ice: Add ice_get_ctrl_ptp() wrapper to simplify the code (Petr Oros) [RHEL-86021]
  - ice: Introduce ice_get_phy_model() wrapper (Petr Oros) [RHEL-86021]
  - ice: Enable 1PPS out from CGU for E825C products (Petr Oros) [RHEL-86021]
  - ice: Read SDP section from NVM for pin definitions (Petr Oros) [RHEL-86021]
  - ice: Disable shared pin on E810 on setfunc (Petr Oros) [RHEL-86021]
  - ice: Cache perout/extts requests and check flags (Petr Oros) [RHEL-86021]
  - ice: Align E810T GPIO to other products (Petr Oros) [RHEL-86021]
  - ice: Add SDPs support for E825C (Petr Oros) [RHEL-86021]
  - ice: Implement ice_ptp_pin_desc (Petr Oros) [RHEL-86021]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.16.1.el9_6]
changelog:
  - soc: qcom: socinfo: Avoid out of bounds read of serial number (Jared Kangas) [RHEL-88252] {CVE-2024-58007}
  - soc: qcom: socinfo: fix revision check in qcom_socinfo_probe() (Jared Kangas) [RHEL-88252]
  - soc: qcom: Add check devm_kasprintf() returned value (Jared Kangas) [RHEL-88252]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.17.1.el9_6]
changelog:
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89113] {CVE-2025-21756}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung (Guillaume Nault) [RHEL-89646] {CVE-2025-37749}
  - cgroup/cpuset: Add warnings to catch inconsistency in exclusive CPUs (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add a remote partition transition test to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Clean up and restructure test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Update test_cpuset_prs.sh to use | as effective CPUs and state separator (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Code cleanup and comment update (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Remove remote_partition_check() & make update_cpumasks_hier() handle remote partition (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix error handling in remote_partition_disable() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix incorrect isolated_cpus update in update_parent_effective_cpumask() (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix race between newly created partition and dying one (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Prevent leakage of isolated CPUs into sched domains (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Enforce at most one rebuild_sched_domains_locked() call per operation (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Revert "Allow suppression of sched domain rebuild in update_cpumasks_hier()" (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Fix spelling errors in file kernel/cgroup/cpuset.c (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Make test_cpuset_prs.sh deal with pre-isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: Account for boot time isolated CPUs (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove use_parent_ecpus of cpuset (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove fetch_xcpus (Waiman Long) [RHEL-88640]
  - selftest/cgroup: Add new test cases to test_cpuset_prs.sh (Waiman Long) [RHEL-88640]
  - cgroup/cpuset: remove child_ecpus_count (Waiman Long) [RHEL-88640]
  - cpuset: use Union-Find to optimize the merging of cpumasks (Waiman Long) [RHEL-88640]
  - Union-Find: add a new module in kernel library (Waiman Long) [RHEL-88640]
  - dm-flakey: Fix memory corruption in optional corrupt_bio_byte feature (CKI Backport Bot) [RHEL-86899] {CVE-2025-21966}
  - ixgbe: fix media type detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbevf: Add support for Intel(R) E610 device (Corinna Vinschen) [RHEL-85809]
  - PCI: Add PCI_VDEVICE_SUB helper macro (Corinna Vinschen) [RHEL-85809]
  - ixgbe: fix media cage present detection for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Enable link management in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Clean up the E610 link management related code (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add ixgbe_x540 multiple header inclusion protection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for EEPROM dump in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for NVM handling in E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add link management support for E610 device (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 device capabilities detection (Corinna Vinschen) [RHEL-85809]
  - ixgbe: Add support for E610 FW Admin Command Interface (Corinna Vinschen) [RHEL-85809]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.18.1.el9_6]
changelog:
  - gitlab-ci: use rhel9.6 builder image (Michael Hofmann)
  - cifs: Fix integer overflow while processing acregmax mount option (CKI Backport Bot) [RHEL-87921] {CVE-2025-21964}
  - Bluetooth: btusb: Add one more ID 0x0489:0xe0f3 for Qualcomm WCN785x (David Marlin) [RHEL-85647]
  - drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in dsc helpers for slices, bpp (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_mode_valid_max_plane_size (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Use joined pipes in intel_dp_joiner_needs_dsc (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Simplify intel_joiner_num_pipes and its usage (Jocelyn Falempe) [RHEL-85393]
  - drm/i915/display: Check whether platform supports joiner (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Handle error during DSC BW overhead/slice calculation" (Jocelyn Falempe) [RHEL-85393]
  - Revert "drm/i915/dp_mst: Don't require DSC hblank quirk for a non-DSC compatible mode" (Jocelyn Falempe) [RHEL-85393]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.19.1.el9_6]
changelog:
  - misc: sgi-gru: fix use-after-free error in gru_set_context_option, gru_fault and gru_handle_user_call_os (David Arcari) [RHEL-87254] {CVE-2022-3424}
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89546] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89546] {CVE-2025-21765}
  - page_pool: Track DMA-mapped pages and unmap them when destroying the pool (Toke Høiland-Jørgensen) [RHEL-84151]
  - page_pool: Move pp_magic check into helper functions (Toke Høiland-Jørgensen) [RHEL-84151]
  - ext4: fallback to complex scan if aligned scan doesn't work (Jay Shin) [RHEL-85984]
  - drm/mgag200: Added support for the new device G200eH5 (Jocelyn Falempe) [RHEL-88907]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.20.1.el9_6]
changelog:
  - wifi: ath12k: Fix invalid data access in ath12k_dp_rx_h_undecap_nwifi (CKI Backport Bot) [RHEL-93253] {CVE-2025-37943}
  - ext4: fix OOB read when checking dotdot dir (CKI Backport Bot) [RHEL-87985] {CVE-2025-37785}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.21.1.el9_6]
changelog:
  - xsk: fix an integer overflow in xp_create_and_assign_umem() (CKI Backport Bot) [RHEL-87911] {CVE-2025-21997}
  - vlan: enforce underlying device type (Guillaume Nault) [RHEL-87884] {CVE-2025-21920}
  - net: fix geneve_opt length integer overflow (Guillaume Nault) [RHEL-87974] {CVE-2025-22055}
  - net: gso: fix ownership in __udp_gso_segment (CKI Backport Bot) [RHEL-88333] {CVE-2025-21926}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.22.1.el9_6]
changelog:
  - Bluetooth: L2CAP: Fix corrupted list in hci_chan_del (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd (David Marlin) [RHEL-87890] {CVE-2025-21969}
  - Revert "SUNRPC: Revert e0a912e8ddba" (Benjamin Coddington) [RHEL-94811]
  - mm/hugetlb: fix kernel NULL pointer dereference when migrating hugetlb folio (Jay Shin) [RHEL-92291]
  - mm: fix crashes from deferred split racing folio migration (Jay Shin) [RHEL-92291] {CVE-2024-42234}
  - mm: memcg: fix split queue list crash when large folio migration (Jay Shin) [RHEL-92291]
  - proc: fix UAF in proc_get_inode() (Ian Kent) [RHEL-86808] {CVE-2025-21999}
  - cifs: Fix integer overflow while processing acdirmax mount option (Paulo Alcantara) [RHEL-87941] {CVE-2025-21963}
  - wifi: cfg80211: init wiphy_work before allocating rfkill fails (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - wifi: cfg80211: cancel wiphy_work before freeing wiphy (CKI Backport Bot) [RHEL-87931] {CVE-2025-21979}
  - eth: bnxt: fix truesize for mb-xdp-pass case (CKI Backport Bot) [RHEL-88328] {CVE-2025-21961}
  - vmxnet3: unregister xdp rxq info in the reset path (CKI Backport Bot) [RHEL-92471]
  - md: fix mddev uaf while iterating all_mddevs list (CKI Backport Bot) [RHEL-89062] {CVE-2025-22126}
  - nvme: print firmware bug note for non-unique identifiers (Bryan Gurney) [RHEL-91163]
  - nvme-pci: add BOGUS_NID quirk for Samsung PM1733 (Bryan Gurney) [RHEL-91163]
  - media: v4l2-mediabus: Drop V4L2_MBUS_CSI2_CONTINUOUS_CLOCK flag (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Drop legacy V4L2_MBUS_CSI2_CHANNEL_* flags (Kate Hsuan) [RHEL-90323]
  - media: v4l2-mediabus: Use structures to describe bus configuration (Kate Hsuan) [RHEL-90323]
  - media: v4l2-fwnode: Move bus config structure to v4l2_mediabus.h (Kate Hsuan) [RHEL-90323]
  - sched/fair: Fix CPU bandwidth limit bypass during CPU hotplug (Phil Auld) [RHEL-86302]
  - smb: client: fix UAF in decryption with multichannel (CKI Backport Bot) [RHEL-94460] {CVE-2025-37750}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.23.1.el9_6]
changelog:
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-94248] {CVE-2025-37738}
  - ibmvnic: Use kernel helpers for hex dumps (CKI Backport Bot) [RHEL-89019] {CVE-2025-22104}
  - ice: Avoid setting default Rx VSI twice in switchdev setup (Petr Oros) [RHEL-88310] {CVE-2025-21883}
  - ice: Fix deinitializing VF in error path (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - ice: add E830 HW VF mailbox message limit support (CKI Backport Bot) [RHEL-88310] {CVE-2025-21883}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-88322] {CVE-2025-21919}
  - redhat: configs: Enable CX231XX driver (Kate Hsuan) [RHEL-89730]
  - media: usb: usbtv: Stop direct calls to queue num_buffers field (Kate Hsuan) [RHEL-89730]
  - media: saa6752hs: Don't set format in sub-device state (Kate Hsuan) [RHEL-89730]
  - media: i2c: Use accessors for pad config 'try_*' fields (Kate Hsuan) [RHEL-89730]
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-93629] {CVE-2025-23150}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.24.1.el9_6]
changelog:
  - Squashfs: fix handling and sanity checking of xattr_ids count (CKI Backport Bot) [RHEL-93465] {CVE-2023-52933}
  - net/mlx5: Fill out devlink dev info only for PFs (CKI Backport Bot) [RHEL-93770]
  - dm mpath: replace spin_lock_irqsave with spin_lock_irq (Benjamin Marzinski) [RHEL-89487]
  - dm-mpath: Don't grab work_mutex while probing paths (Benjamin Marzinski) [RHEL-89487]
  - dm mpath: Interface for explicit probing of active paths (Benjamin Marzinski) [RHEL-89487]
  - dm: Allow .prepare_ioctl to handle ioctls directly (Benjamin Marzinski) [RHEL-89487]
  - NFS: O_DIRECT writes must check and adjust the file length (Benjamin Coddington) [RHEL-96060]
  - pnfs/flexfiles: retry getting layout segment for reads (Benjamin Coddington) [RHEL-96060]
  - NFS/pnfs: Fix a live lock between recalled layouts and layoutget (Benjamin Coddington) [RHEL-96060]
  - x86/tsc: Use topology_max_packages() to get package number (David Arcari) [RHEL-96886]
  - scsi: storvsc: Explicitly set max_segment_size to UINT_MAX (Ewan D. Milne) [RHEL-97519]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.25.1.el9_6]
changelog:
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99124] {CVE-2022-49846}
  - vmxnet3: Fix malformed packet sizing in vmxnet3_process_xdp (CKI Backport Bot) [RHEL-97110] {CVE-2025-37799}
  - NFSv4: Don't check for OPEN feature support in v4.1 (Scott Mayhew) [RHEL-95252]
  - ipv6: mcast: extend RCU protection in igmp6_send() (CKI Backport Bot) [RHEL-94673] {CVE-2025-21759}
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up (CKI Backport Bot) [RHEL-93445] {CVE-2025-21887}
  - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93132] {CVE-2025-22004}
  - block: make sure ->nr_integrity_segments is cloned in blk_rq_prep_clone (Ming Lei) [RHEL-92268]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.26.1.el9_6]
changelog:
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98996] {CVE-2025-21991}
  - cpufreq: intel_pstate: Unchecked MSR aceess in legacy mode (David Arcari) [RHEL-90212]
  - smb: client: fix perf regression with deferred closes (Paulo Alcantara) [RHEL-97482]
  - smb3 client: fix open hardlink on deferred close file error (Paulo Alcantara) [RHEL-97482]
  - Fix mmu notifiers for range-based invalidates (Jay Shin) [RHEL-93743]
  - vfio/pci: Align huge faults to order (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use mapping page mask for pfnmaps (Alex Williamson) [RHEL-88275]
  - mm: Provide address mask in struct follow_pfnmap_args (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use consistent types for page counts (Alex Williamson) [RHEL-88275]
  - vfio/type1: Use vfio_batch for vaddr_get_pfns() (Alex Williamson) [RHEL-88275]
  - vfio/type1: Convert all vaddr_get_pfns() callers to use vfio_batch (Alex Williamson) [RHEL-88275]
  - vfio/type1: Catch zero from pin_user_pages_remote() (Alex Williamson) [RHEL-88275]
  - vfio/pci: Fallback huge faults for unaligned pfn (Donald Dutile) [RHEL-85623]
  - vfio/pci: implement huge_fault support (Donald Dutile) [RHEL-85623]
  - vfio/pci: Remove unused struct 'vfio_pci_mmap_vma' (Donald Dutile) [RHEL-85623]
  - vfio/pci: Insert full vma on mmap'd MMIO fault (Donald Dutile) [RHEL-85623]
  - vfio/pci: Use unmap_mapping_range() (Donald Dutile) [RHEL-85623]
  - mm/arm64: support large pfn mappings (Donald Dutile) [RHEL-85623]
  - mm/x86: support large pfn mappings (Donald Dutile) [RHEL-85623]
  - mm: remove follow_pte() (Donald Dutile) [RHEL-85623]
  - mm: follow_pte() improvements (Donald Dutile) [RHEL-85623]
  - mm/access_process_vm: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - vfio: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm/x86/pat: use the new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - s390/pci_mmio: use follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - KVM: use follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm: pass VMA instead of MM to follow_pte() (Donald Dutile) [RHEL-85623]
  - mm: move follow_phys to arch/x86/mm/pat/memtype.c (Donald Dutile) [RHEL-85623]
  - mm: fix follow_pfnmap API lockdep assert (Donald Dutile) [RHEL-85623]
  - mm: new follow_pfnmap API (Donald Dutile) [RHEL-85623]
  - mm: remove follow_pfn (Donald Dutile) [RHEL-85623]
  - mm: always define pxx_pgprot() (Donald Dutile) [RHEL-85623]
  - mm/huge_memory: check pmd_special() only after pmd_present() (Donald Dutile) [RHEL-85623]
  - mm/fork: accept huge pfnmap entries (Donald Dutile) [RHEL-85623]
  - mm/pagewalk: check pfnmap for folio_walk_start() (Donald Dutile) [RHEL-85623]
  - mm/gup: detect huge pfnmap entries in gup-fast (Donald Dutile) [RHEL-85623]
  - mm: mark special bits for huge pfn mappings when inject (Donald Dutile) [RHEL-85623]
  - mm: drop is_huge_zero_pud() (Donald Dutile) [RHEL-85623]
  - mm: introduce ARCH_SUPPORTS_HUGE_PFNMAP and special bits to pmd/pud (Donald Dutile) [RHEL-85623]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.27.1.el9_6]
changelog:
  - i2c: tegra: check msg length in SMBUS block read (Steve Dunnagan) [RHEL-100516]
  - net/mlx5: Generate PPS IN event on new function for shared clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Support one PTP device per hardware clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Move PPS notifier and out_work to clock_state (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add devcom component for the clock shared by functions (Michal Schmidt) [RHEL-87775]
  - net/mlx5: Change clock in mlx5_core_dev to mlx5_clock pointer (Michal Schmidt) [RHEL-87775]
  - net/mlx5: Add API to get mlx5_core_dev from mlx5_clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add init and destruction functions for a single HW clock (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Change parameters for PTP internal functions (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add helper functions for PTP callbacks (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: Add support for MRTCQ register (Benjamin Poirier) [RHEL-87775]
  - net/mlx5: use do_aux_work for PHC overflow checks (Michal Schmidt) [RHEL-87775]
  - mlx5_en: use read sequence for gettimex64 (Benjamin Poirier) [RHEL-87775]
  - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98772] {CVE-2024-58002}
  - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98772]
  - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98772]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.28.1.el9_6]
changelog:
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error (CKI Backport Bot) [RHEL-101327] {CVE-2025-38089}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.29.1.el9_6]
changelog:
  - tcp: adjust rcvq_space after updating scaling ratio (Guillaume Nault) [RHEL-99145]
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
  - ext4: introduce ITAIL helper (CKI Backport Bot) [RHEL-93555] {CVE-2025-22121}
  - ext4: avoid journaling sb update on error if journal is destroying (Brian Foster) [RHEL-93591] {CVE-2025-22113}
  - ext4: define ext4_journal_destroy wrapper (Brian Foster) [RHEL-93591]
  - net/mdiobus: Fix potential out-of-bounds clause 45 read/write access (CKI Backport Bot) [RHEL-102093] {CVE-2025-38110}
  - smb: client: fix regression with native SMB symlinks (Paulo Alcantara) [RHEL-101953]
  - redhat/configs: remove automotive directory (Eric Chanudet) [RHEL-96365]
  - r8169: enable RTL8168H/RTL8168EP/RTL8168FP ASPM support (CKI Backport Bot) [RHEL-96715]
  - r8169: disable RTL8126 ZRX-DC timeout (CKI Backport Bot) [RHEL-96715]
  - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101212] {CVE-2025-38086}
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98795] {CVE-2024-57980}
  - RDMA/mlx5: Fix page_size variable overflow (CKI Backport Bot) [RHEL-99320] {CVE-2025-22091}
  - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99384] {CVE-2025-21905}
  - RDMA/core: Fix use-after-free when rename device name (CKI Backport Bot) [RHEL-99048] {CVE-2025-22085}
  - octeon_ep: Fix host hang issue during device reboot (CKI Backport Bot) [RHEL-93251]
  - mm/huge_memory: fix dereferencing invalid pmd migration entry (Rafael Aquini) [RHEL-96368] {CVE-2025-37958}
  - octeon_ep_vf: Resolve netdevice usage count issue (CKI Backport Bot) [RHEL-93252]
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (CKI Backport Bot) [RHEL-87555]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.30.1.el9_6]
changelog:
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (Davide Caratti) [RHEL-95853] {CVE-2025-37797}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.31.1.el9_6]
changelog:
  - Bluetooth: btusb: avoid NULL pointer dereference in skb_dequeue() (David Marlin) [RHEL-95324] {CVE-2025-37918}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (Desnes Nunes) [RHEL-99029] {CVE-2025-22020}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (John W. Linville) [RHEL-97499] {CVE-2022-49788}
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103087]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103087] {CVE-2025-38052}
  - md/raid1: Add check for missing source disk in process_checks() (CKI Backport Bot) [RHEL-97439]
  - net/sched: fix use-after-free in taprio_dev_notifier (CKI Backport Bot) [RHEL-101317] {CVE-2025-38087}
  - padata: avoid UAF for reorder_work (Rafael Aquini) [RHEL-97031] {CVE-2025-21727 CVE-2025-21726}
  - padata: fix UAF in padata_reorder (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: add pd get/put refcnt helper (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: fix sysfs store callback check (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - padata: Clean up in padata_do_multithreaded() (Rafael Aquini) [RHEL-97031] {CVE-2025-21727}
  - platform/x86: dell_rbu: Fix list usage (David Arcari) [RHEL-100908]
  - cifs: Fix integer overflow while processing closetimeo mount option (CKI Backport Bot) [RHEL-87900] {CVE-2025-21962}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.32.1.el9_6]
changelog:
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Davide Caratti) [RHEL-97522] {CVE-2025-38001 CVE-2025-37890}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Davide Caratti) [RHEL-97522] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (Davide Caratti) [RHEL-97522] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Ivan Vecera) [RHEL-97522]
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98847] {CVE-2025-21928}
  - HID: intel-ish-hid: Fix use-after-free issue in hid_ishtp_cl_remove() (CKI Backport Bot) [RHEL-98871] {CVE-2025-21929}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.33.1.el9_6]
changelog:
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93387] {CVE-2025-38350}
  - redhat: update BUILD_TARGET to rhel-9.6.0-z-test-pesign (Jan Stancek)
  - PCI: Use downstream bridges for distributing resources (Jennifer Berringer) [RHEL-102666]
  - PCI/ACS: Fix 'pci=config_acs=' parameter (Charles Mirabile) [RHEL-102652]
  - PCI: Fix pci_enable_acs() support for the ACS quirks (Charles Mirabile) [RHEL-102652]
  - Documentation: Fix pci=config_acs= example (Charles Mirabile) [RHEL-102652]
  - Revert "PCI: Wait for device readiness with Configuration RRS" (John W. Linville) [RHEL-94414]
  - bnxt_en: Skip MAC loopback selftest if it is unsupported by FW (CKI Backport Bot) [RHEL-82564]
  - bnxt_en: Skip PHY loopback ethtool selftest if unsupported by FW (CKI Backport Bot) [RHEL-82564]
  - wifi: ath12k: fix invalid access to memory (CKI Backport Bot) [RHEL-103219] {CVE-2025-38292}
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102235] {CVE-2025-38079}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.33.2.el9_6]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Patrick Talbert) [RHEL-108138]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.34.1.el9_6]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106625] {CVE-2025-38380}
  - tls: always refresh the queue when reading sock (CKI Backport Bot) [RHEL-106081] {CVE-2025-38471}
  - net: fix udp gso skb_segment after pull from frag_list (Guillaume Nault) [RHEL-103028] {CVE-2025-38124}
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101246] {CVE-2025-38085}
  - mm/hugetlb: unshare page tables during VMA split, not before (Rafael Aquini) [RHEL-101282] {CVE-2025-38084}
  - mm: fix copy_vma() error handling for hugetlb mappings (Rafael Aquini) [RHEL-101282]
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (CKI Backport Bot) [RHEL-103256] {CVE-2025-38250}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.35.1.el9_6]
changelog:
  - s390/dasd: Remove DMA alignment (CKI Backport Bot) [RHEL-91593]
  - s390/cpumf: Update CPU Measurement facility extended counter set support (CKI Backport Bot) [RHEL-103066]
  - s390/topology: Improve topology detection (CKI Backport Bot) [RHEL-92100]
  - s390/pai: export number of sysfs attribute files (CKI Backport Bot) [RHEL-87178]
  - s390/pai: fix attr_event_free upper limit for pai device drivers (CKI Backport Bot) [RHEL-87178]
  - powerpc/64s/radix/kfence: map __kfence_pool at page granularity (Mamatha Inamdar) [RHEL-92081]
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103151] {CVE-2025-38159}
  - redhat: Mark kernel incompatible with xdp-tools<1.5.4 (Felix Maurer) [RHEL-101008]
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() (CKI Backport Bot) [RHEL-101008] {CVE-2025-21867}
  - arm64: proton-pack: Add new CPUs 'k' values for branch mitigation (Waiman Long) [RHEL-100603]
  - arm64: bpf: Only mitigate cBPF programs loaded by unprivileged users (Waiman Long) [RHEL-100603] {CVE-2025-37963}
  - arm64: bpf: Add BHB mitigation to the epilogue for cBPF programs (Waiman Long) [RHEL-100603] {CVE-2025-37948}
  - arm64: proton-pack: Expose whether the branchy loop k value (Waiman Long) [RHEL-100603]
  - arm64: proton-pack: Expose whether the platform is mitigated by firmware (Waiman Long) [RHEL-100603]
  - arm64: insn: Add support for encoding DSB (Waiman Long) [RHEL-100603]
  - redhat/configs: Enable CONFIG_MITIGATION_ITS for x86 (Waiman Long) [RHEL-100603]
  - selftest/x86/bugs: Add selftests for ITS (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/ibt: Keep IBT disabled during alternative patching (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Align RETs in BHB clear sequence to avoid thunking (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for RSB stuffing mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add "vmexit" option to skip mitigation on some CPUs (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Enable Indirect Target Selection mitigation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe return thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Add support for ITS-safe indirect thunk (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/its: Enumerate Indirect Target Selection (ITS) bug (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - Documentation: x86/bugs/its: Add ITS documentation (Waiman Long) [RHEL-100603 RHEL-92182] {CVE-2024-28956}
  - x86/bhi: Do not set BHI_DIS_S in 32-bit mode (Waiman Long) [RHEL-100603]
  - x86/bpf: Add IBHF call at end of classic BPF (Waiman Long) [RHEL-100603]
  - x86/bpf: Call branch history clearing sequence on exit (Waiman Long) [RHEL-100603]
  - arm64: errata: Assume that unknown CPUs _are_ vulnerable to Spectre BHB (Waiman Long) [RHEL-100603]
  - arm64: errata: Add QCOM_KRYO_4XX_GOLD to the spectre_bhb_k24_list (Waiman Long) [RHEL-100603]
  - x86/rfds: Exclude P-only parts from the RFDS affected list (Waiman Long) [RHEL-100603]
  - x86/cpu: Update x86_match_cpu() to also use cpu-type (Waiman Long) [RHEL-100603]
  - x86/cpu: Add cpu_type to struct x86_cpu_id (Waiman Long) [RHEL-100603]
  - x86/cpu: Shorten CPU matching macro (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix the description of X86_MATCH_VFM_STEPS() (Waiman Long) [RHEL-100603]
  - selftests: Warn about skipped tests in result summary (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix typo in x86_match_cpu()'s doc (Waiman Long) [RHEL-100603]
  - x86/cpu: Expose only stepping min/max interface (Waiman Long) [RHEL-100603]
  - x86/cpu: Add CPU type to struct cpuinfo_topology (Waiman Long) [RHEL-100603]
  - x86/cpufeatures: Add X86_FEATURE_AMD_HETEROGENEOUS_CORES (Waiman Long) [RHEL-100603]
  - x86/cpufeatures: Rename X86_FEATURE_FAST_CPPC to have AMD prefix (Waiman Long) [RHEL-100603]
  - tools/include: Sync x86 headers with the kernel sources (Waiman Long) [RHEL-100603]
  - selftests: ksft: Fix finished() helper exit code on skipped tests (Waiman Long) [RHEL-100603]
  - kselftest: Move ksft helper module to common directory (Waiman Long) [RHEL-100603]
  - platform/x86/intel/ifs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/platform/atom: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - cpufreq: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/bugs: Add 'spectre_bhi=vmexit' cmdline option (Waiman Long) [RHEL-100603]
  - EDAC/skx: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - EDAC/i10nm: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/cpu: Fix x86_match_cpu() to match just X86_VENDOR_INTEL (Waiman Long) [RHEL-100603]
  - x86/aperfmperf: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/apic: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - x86/bugs: Switch to new Intel CPU model defines (Waiman Long) [RHEL-100603]
  - EDAC/i10nm: Add Intel Grand Ridge micro-server support (Waiman Long) [RHEL-100603]
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Patrick Talbert) [RHEL-108138]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Patrick Talbert) [RHEL-108138]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Patrick Talbert) [RHEL-108138]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.36.1.el9_6]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104091] {CVE-2025-22058}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (CKI Backport Bot) [RHEL-104719] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Ivan Vecera) [RHEL-104719]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.37.1.el9_6]
changelog:
  - ice: fix eswitch code memory leak in reset scenario (CKI Backport Bot) [RHEL-108152] {CVE-2025-38417}
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-105151]
  - ethtool: Fix set RXNFC command with symmetric RSS hash (Mohammad Heib) [RHEL-103526]
  - drm/i915: Give i915 and xe each their own display tracepoints (Jocelyn Falempe) [RHEL-94419]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.38.1.el9_6]
changelog:
  - net/sched: ets: use old 'nbands' while purging unused classes (CKI Backport Bot) [RHEL-107537] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107537] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93387] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93387] {CVE-2025-37932}
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-107630] {CVE-2025-37823}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (CKI Backport Bot) [RHEL-106046] {CVE-2025-38200}
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-106003] {CVE-2025-38461}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (CKI Backport Bot) [RHEL-104273] {CVE-2025-38211}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.39.1.el9_6]
changelog:
  - xfrm: interface: fix use-after-free after changing collect_md xfrm interface (CKI Backport Bot) [RHEL-109529] {CVE-2025-38500}
  - Merge: net: mana: Fix race of mana_hwc_post_rx_wqe and new hwc response [rhel-9.6.z] (Maxim Levitsky) [RHEL-58904]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-102036]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-102036]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-102036]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-102036]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Thomas Huth) [RHEL-102036] {CVE-2025-37946}
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-102036] {CVE-2025-37974}
  - s390/pci: Fix potential double remove of hotplug slot (Thomas Huth) [RHEL-102036] {CVE-2024-56699}
  - s390/pci: remove hotplug slot when releasing the device (Thomas Huth) [RHEL-102036]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Thomas Huth) [RHEL-102036]
  - s390/pci: rename lock member in struct zpci_dev (Thomas Huth) [RHEL-102036]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107895]
  - i40e: report VF tx_dropped with tx_errors instead of tx_discards (Dennis Chen) [RHEL-105137]
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-94815]
  - s390/pci: Fix handling of isolated VFs (CKI Backport Bot) [RHEL-85387]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (CKI Backport Bot) [RHEL-85387]
  - s390/pci: Fix SR-IOV for PFs initially in standby (CKI Backport Bot) [RHEL-85387]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106651] {CVE-2025-38464}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-106415] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-106415]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-106415]
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103555]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.41.1.el9_6]
changelog:
  - powerpc/pseries/iommu: Fix kmemleak in TCE table userspace view (Mamatha Inamdar) [RHEL-107002]
  - net: ibmveth: make veth_pool_store stop hanging (Mamatha Inamdar) [RHEL-109494]
  - ibmveth: Always stop tx queues during close (Mamatha Inamdar) [RHEL-109494]
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-109723]
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-109723]
  - smb: convert to ctime accessor functions (Paulo Alcantara) [RHEL-109723]
  - crypto: tegra - Fix IV usage for AES ECB (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix format specifier in tegra_sha_prep_cmd() (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Use HMAC fallback when keyslots are full (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Reserve keyslots to allocate dynamically (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Set IV to NULL explicitly for AES ECB (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix CMAC intermediate result handling (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Fix HASH intermediate result handling (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Transfer HASH init function to crypto engine (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - check return value for hash do_one_req (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - finalize crypto req on error (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Do not use fixed size buffers (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - Use separate buffer for setkey (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - remove unneeded crypto_engine_stop() call (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - remove redundant error check on ret (Nirmala Dalvi) [RHEL-107286]
  - crypto: tegra - do not transfer req when tegra init fails (Nirmala Dalvi) [RHEL-107286]
  - crypto: engine - Remove prepare/unprepare request (Nirmala Dalvi) [RHEL-107286]
  - udmabuf: fix a buf size overflow issue during udmabuf creation (CKI Backport Bot) [RHEL-99746] {CVE-2025-37803}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.42.1.el9_6]
changelog:
  - powerpc/pseries/iommu: memory notifier incorrectly adds TCEs for pmemory (Mamatha Inamdar) [RHEL-103015]
  - drm/framebuffer: Acquire internal references on GEM handles (José Expósito) [RHEL-106699] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (José Expósito) [RHEL-106699] {CVE-2025-38449}
  - drm/vkms: Fix use after free and double free on init error (CKI KWF BOT) [RHEL-99420] {CVE-2025-22097}
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105933] {CVE-2025-38332}


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-570.42.2.el9_6]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112780] {CVE-2025-38352}
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (CKI Backport Bot) [RHEL-113173]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.43.1.el9_6]
changelog:
  - eth: bnxt: fix missing ring index trim on error path (CKI Backport Bot) [RHEL-104561] {CVE-2025-37873}
  - book3s64/radix : Align section vmemmap start address to PAGE_SIZE (Mamatha Inamdar) [RHEL-109492]
  - book3s64/radix: Fix compile errors when CONFIG_ARCH_WANT_OPTIMIZE_DAX_VMEMMAP=n (Mamatha Inamdar) [RHEL-109492]
  - net: introduce per netns packet chains (Paolo Abeni) [RHEL-89050]
  - enic: fix incorrect MTU comparison in enic_change_mtu() (John Meneghini) [RHEL-108274]
  - net/enic: Allow at least 8 RQs to always be used (John Meneghini) [RHEL-108274]
  - enic: get max rq & wq entries supported by hw, 16K queues (John Meneghini) [RHEL-106604]
  - enic: cleanup of enic wq request completion path (John Meneghini) [RHEL-106604]
  - enic: added enic_wq.c and enic_wq.h (John Meneghini) [RHEL-106604]
  - enic: remove unused function cq_enet_wq_desc_dec (John Meneghini) [RHEL-106604]
  - enic: enable rq extended cq support (John Meneghini) [RHEL-106604]
  - enic: enic rq extended cq defines (John Meneghini) [RHEL-106604]
  - enic: enic rq code reorg (John Meneghini) [RHEL-106604]
  - enic: Move function from header file to c file (John Meneghini) [RHEL-106604]
  - enic: add dependency on Page Pool (John Meneghini) [RHEL-106604]
  - enic: remove copybreak tunable (John Meneghini) [RHEL-106604]
  - enic: Use the Page Pool API for RX (John Meneghini) [RHEL-106604]
  - enic: Simplify RX handler function (John Meneghini) [RHEL-106604]
  - enic: Move RX functions to their own file (John Meneghini) [RHEL-106604]
  - enic: Fix typo in comment in table indexed by link speed (John Meneghini) [RHEL-106604]
  - enic: Obtain the Link speed only after the link comes up (John Meneghini) [RHEL-106604]
  - enic: Move RX coalescing set function (John Meneghini) [RHEL-106604]
  - enic: Move kdump check into enic_adjust_resources() (John Meneghini) [RHEL-106604]
  - enic: Move enic resource adjustments to separate function (John Meneghini) [RHEL-106604]
  - enic: Adjust used MSI-X wq/rq/cq/interrupt resources in a more robust way (John Meneghini) [RHEL-106604]
  - enic: Allocate arrays in enic struct based on VIC config (John Meneghini) [RHEL-106604]
  - enic: Save resource counts we read from HW (John Meneghini) [RHEL-106604]
  - enic: Make MSI-X I/O interrupts come after the other required ones (John Meneghini) [RHEL-106604]
  - enic: Create enic_wq/rq structures to bundle per wq/rq data (John Meneghini) [RHEL-106604]
  - enic: Report some per queue statistics in ethtool (John Meneghini) [RHEL-106604]
  - enic: Report per queue statistics in netdev qstats (John Meneghini) [RHEL-106604]
  - enic: Collect per queue statistics (John Meneghini) [RHEL-106604]
  - enic: Use macro instead of static const variables for array sizes (John Meneghini) [RHEL-106604]
  - enic: add ethtool get_channel support (John Meneghini) [RHEL-106604]
  - enic: Validate length of nl attributes in enic_set_vf_port (John Meneghini) [RHEL-106604]
  - enic: Replace hardcoded values for vnic descriptor by defines (John Meneghini) [RHEL-106604]
  - enic: Avoid false positive under FORTIFY_SOURCE (John Meneghini) [RHEL-106604]
  - scsi: fnic: Fix missing DMA mapping error in fnic_send_frame() (John Meneghini) [RHEL-106420]
  - scsi: fnic: Set appropriate logging level for log message (John Meneghini) [RHEL-106420]
  - scsi: fnic: Add and improve logs in FDMI and FDMI ABTS paths (John Meneghini) [RHEL-106420]
  - scsi: fnic: Turn off FDMI ACTIVE flags on link down (John Meneghini) [RHEL-106420]
  - scsi: fnic: Fix crash in fnic_wq_cmpl_handler when FDMI times out (John Meneghini) [RHEL-106420]
  - scsi: fnic: Remove unnecessary NUL-terminations (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove redundant flush_workqueue() calls (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary spinlock locking and unlocking (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace fnic->lock_flags with local flags (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace use of sizeof with standard usage (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix indentation and remove unnecessary parenthesis (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary debug print (John Meneghini) [RHEL-106419]
  - scsi: fnic: Propagate SCSI error code from fnic_scsi_drv_init() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Test for memory allocation failure and return error code (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return appropriate error code from failure of scsi drv init (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return appropriate error code for mem alloc failure (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove always-true IS_FNIC_FCP_INITIATOR macro (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix use of uninitialized value in debug message (John Meneghini) [RHEL-106419]
  - scsi: fnic: Delete incorrect debugfs error handling (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary else to fix warning in FDLS FIP (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove extern definition from .c files (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unnecessary else and unnecessary break in FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support to handle port channel RSCN (John Meneghini) [RHEL-106419]
  - scsi: fnic: Code cleanup (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add stats and related functionality (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify fnic interfaces to use FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify IO path to use FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add functionality in fnic to support FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and integrate support for FIP (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and integrate support for FDMI (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add Cisco hardware model names (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for unsolicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for target based solicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for fabric based solicited requests and responses (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add headers and definitions for FDLS (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace shost_printk() with dev_info()/dev_err() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vcalloc() instead of vmalloc() and memset(0) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Move flush_work initialization out of if block (John Meneghini) [RHEL-106419]
  - scsi: fnic: Move fnic_fnic_flush_tx() to a work queue (John Meneghini) [RHEL-106419]
  - scsi: fnic: Convert snprintf() to sysfs_emit() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Clean up some inconsistent indenting (John Meneghini) [RHEL-106419]
  - scsi: fnic: unlock on error path in fnic_queuecommand() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Increment driver version (John Meneghini) [RHEL-106419]
  - scsi: fnic: Improve logs and add support for multiqueue (MQ) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for multiqueue (MQ) in fnic driver (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add support for multiqueue (MQ) in fnic_main.c (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove usage of host_lock (John Meneghini) [RHEL-106419]
  - scsi: fnic: Define stats to track multiqueue (MQ) IOs (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify ISRs to support multiqueue (MQ) (John Meneghini) [RHEL-106419]
  - scsi: fnic: Refactor and redefine fnic.h for multiqueue (John Meneghini) [RHEL-106419]
  - scsi: fnic: Get copy workqueue count and interrupt mode from config (John Meneghini) [RHEL-106419]
  - scsi: fnic: Rename wq_copy to hw_copy_wq (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and improve log messages (John Meneghini) [RHEL-106419]
  - scsi: fnic: Add and use fnic number (John Meneghini) [RHEL-106419]
  - scsi: fnic: Modify definitions to sync with VIC firmware (John Meneghini) [RHEL-106419]
  - scsi: fnic: Return error if vmalloc() failed (John Meneghini) [RHEL-106419]
  - scsi: fnic: Clean up some inconsistent indenting (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix sg_reset success path (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unused functions fnic_scsi_host_start/end_tag() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace sgreset tag with max_tag_id (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace return codes in fnic_clean_pending_aborts() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vmalloc_array() and vcalloc() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Use vzalloc() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Refactor code in fnic probe to initialize SCSI layer (John Meneghini) [RHEL-106419]
  - scsi: fnic: Replace DMA mask of 64 bits with 47 bits (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove unneeded flush_workqueue() (John Meneghini) [RHEL-106419]
  - scsi: fnic: Remove redundant NULL check (John Meneghini) [RHEL-106419]
  - scsi: fnic: Stop using the SCSI pointer (John Meneghini) [RHEL-106419]
  - scsi: fnic: Fix a tracing statement (John Meneghini) [RHEL-106419]
  - scsi: fnic: Call scsi_done() directly (John Meneghini) [RHEL-106419]
  - Revert "driver core: Fix uevent_show() vs driver detach race" (Mark Langsdorf) [RHEL-85410]


author: Chao YE <cye@redhat.com> [5.14.0-570.44.1.el9_6]
changelog:
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() (CKI Backport Bot) [RHEL-111149] {CVE-2025-38550}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (CKI Backport Bot) [RHEL-112780] {CVE-2025-38352}
  - powerpc/pseries/iommu: create DDW for devices with DMA mask less than 64-bits (CKI Backport Bot) [RHEL-113173]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.45.1.el9_6]
changelog:
  - tunnels: Accept PACKET_HOST in skb_tunnel_check_pmtu(). (Adrian Moreno) [RHEL-113279]
  - igc: fix lock order in igc_ptp_reset (CKI Backport Bot) [RHEL-108118]
  - igc: add lock preventing multiple simultaneous PTM transactions (CKI Backport Bot) [RHEL-108118]
  - igc: cleanup PTP module if probe fails (CKI Backport Bot) [RHEL-108118]
  - igc: handle the IGC_PTP_ENABLED flag correctly (CKI Backport Bot) [RHEL-108118]
  - igc: move ktime snapshot into PTM retry loop (CKI Backport Bot) [RHEL-108118]
  - igc: increase wait time before retrying PTM (CKI Backport Bot) [RHEL-108118]
  - igc: fix PTM cycle trigger logic (CKI Backport Bot) [RHEL-108118]
  - ice: use fixed adapter index for E825C embedded devices (CKI Backport Bot) [RHEL-111766]
  - ice: use DSN instead of PCI BDF for ice_adapter index (CKI Backport Bot) [RHEL-111766]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.46.1.el9_6]
changelog:
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112246] {CVE-2023-53125}
  - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112246] {CVE-2023-53125}
  - s390/sclp: Fix SCCB present check (CKI Backport Bot) [RHEL-113558] {CVE-2025-39694}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107301] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107301] {CVE-2025-38498}
  - usb: dwc3: gadget: check that event count does not exceed event buffer length (CKI Backport Bot) [RHEL-107649] {CVE-2025-37810}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.47.1.el9_6]
changelog:
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113916]
  - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113333] {CVE-2025-38718}
  - ice: fix max values for dpll pin phase adjust (Petr Oros) [RHEL-113039]
  - ice/ptp: fix crosstimestamp reporting (Petr Oros) [RHEL-112558]
  - ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-112873]
  - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-112873]
  - ice: Implement PTP support for E830 devices (Petr Oros) [RHEL-112558]
  - ice: Refactor ice_ptp_init_tx_* (Petr Oros) [RHEL-112558]
  - ice: Add unified ice_capture_crosststamp (Petr Oros) [RHEL-112558]
  - ice: Process TSYN IRQ in a separate function (Petr Oros) [RHEL-112558]
  - ice: Use FIELD_PREP for timestamp values (Petr Oros) [RHEL-112558]
  - ice: Remove unnecessary ice_is_e8xx() functions (Petr Oros) [RHEL-112558]
  - ice: Don't check device type when checking GNSS presence (Petr Oros) [RHEL-112558]
  - ice: Add in/out PTP pin delays (Petr Oros) [RHEL-112558]
  - ice: fix PHY timestamp extraction for ETH56G (Petr Oros) [RHEL-112558]
  - ice: Add correct PHY lane assignment (Petr Oros) [RHEL-112683]
  - ice: Fix ETH56G FC-FEC Rx offset value (Petr Oros) [RHEL-112683]
  - ice: Fix quad registers read on E825 (Petr Oros) [RHEL-112683]
  - ice: Fix E825 initialization (Petr Oros) [RHEL-112683]
  - tcp: drop secpath at the same time as we currently drop dst (Sabrina Dubroca) [RHEL-82136]
  - smb: client: fix use-after-free in cifs_oplock_break (CKI Backport Bot) [RHEL-111196] {CVE-2025-38527}
  - i40e: When removing VF MAC filters, only check PF-set MAC (CKI Backport Bot) [RHEL-109571]
  - cpufreq/cppc: Don't compare desired_perf in target() (Mark Langsdorf) [RHEL-109525]
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry (CKI Backport Bot) [RHEL-106432] {CVE-2025-38472}
  - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-91800]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.48.1.el9_6]
changelog:
  - perf trace: Add missing perf_tool__init() (Michael Petlan) [RHEL-105393]
  - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-114962]
  - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-114962]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.49.1.el9_6]
changelog:
  - io_uring/futex: ensure io_futex_wait() cleans up properly on failure (CKI Backport Bot) [RHEL-114335] {CVE-2025-39698}
  - selftests: tls: add tests for zero-length records (Sabrina Dubroca) [RHEL-114326] {CVE-2025-39682}
  - tls: fix handling of zero-length records on the rx_list (Sabrina Dubroca) [RHEL-114326] {CVE-2025-39682}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.50.1.el9_6]
changelog:
  - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68092] {CVE-2024-50301}
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-104730] {CVE-2025-38351}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.51.1.el9_6]
changelog:
  - wifi: ath12k: Decrement TID on RX peer frag setup error handling (CKI Backport Bot) [RHEL-114705] {CVE-2025-39761}
  - RDMA/cxgb4: Notify rdma stack for IB_EVENT_QP_LAST_WQE_REACHED event (CKI Backport Bot) [RHEL-100798]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.52.1.el9_6]
changelog:
  - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117232] {CVE-2023-53373}
  - ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116186]
  - hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-115069]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-115069]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-115069]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-115069]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-115069]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-115069]
  - hv_netvsc: Set VF priv_flags to IFF_NO_ADDRCONF before open to prevent IPv6 addrconf (Maxim Levitsky) [RHEL-115069]
  - net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-115069]
  - net: mana: Add support for Multi Vports on Bare metal (Maxim Levitsky) [RHEL-115069]
  - net: mana: Switch to page pool for jumbo frames (Maxim Levitsky) [RHEL-115069]
  - net: mana: Add metadata support for xdp mode (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: Handle net event for pointing to the current netdev (Maxim Levitsky) [RHEL-115069]
  - net: mana: Change the function signature of mana_get_primary_netdev_rcu (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: Ensure variable err is initialized (Maxim Levitsky) [RHEL-115069]
  - net: mana: Add debug logs in MANA network driver (Maxim Levitsky) [RHEL-115069]
  - hv_netvsc: Use VF's tso_max_size value when data path is VF (Maxim Levitsky) [RHEL-115069]
  - net: mana: Allow tso_max_size to go up-to GSO_MAX_SIZE (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: request error CQEs when supported (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: Query feature_flags bitmask from FW (Maxim Levitsky) [RHEL-115069]
  - net: mana: Support holes in device list reply msg (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: Allocate PAGE aligned doorbell index (Maxim Levitsky) [RHEL-115069]
  - hv_netvsc: Link queues to NAPIs (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: use the correct page size for mapping user-mode doorbell page (Maxim Levitsky) [RHEL-115069]
  - RDMA/mana_ib: use the correct page table index based on hardware page size (Maxim Levitsky) [RHEL-115069]
  - net: mana: Fix doorbell out of order violation and avoid unnecessary doorbell rings (Maxim Levitsky) [RHEL-115069]
  - net: mana: Fix RX buf alloc_size alignment and atomic op panic (Maxim Levitsky) [RHEL-115069]
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (CKI Backport Bot) [RHEL-114688] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (CKI Backport Bot) [RHEL-114688]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (CKI Backport Bot) [RHEL-114688] {CVE-2025-39757}
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111036] {CVE-2025-38556}
  - eventpoll: Fix semi-unbounded recursion (CKI Backport Bot) [RHEL-111052] {CVE-2025-38614}
  - smb: client: fix session setup against servers that require SPN (Paulo Alcantara) [RHEL-107109]
  - smb: client: allow parsing zero-length AV pairs (Paulo Alcantara) [RHEL-107109]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.53.1.el9_6]
changelog:
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117578] {CVE-2025-39849}
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114436]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114436]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114436]
  - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-93610] {CVE-2025-22026}
  - irdma: free iwdev->rf after removing MSI-X (CKI Backport Bot) [RHEL-111485]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.54.1.el9_6]
changelog:
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-113836] {CVE-2022-50087}
  - SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110811]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110811] {CVE-2025-38571}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118256] {CVE-2025-39817}
  - sunrpc: fix handling of server side tls alerts (Steve Dickson) [RHEL-111070] {CVE-2025-38566}
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (Jay Shin) [RHEL-116679]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.55.1.el9_6]
changelog:
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119115] {CVE-2025-39841}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.56.1.el9_6]
changelog:
  - NFS: Return the file btime in the statx results when appropriate (Benjamin Coddington) [RHEL-111706]
  - nfs: Add timecreate to nfs inode (Benjamin Coddington) [RHEL-111706]
  - Expand the type of nfs_fattr->valid (Benjamin Coddington) [RHEL-111706]
  - smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-117879]
  - smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-117879]
  - smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-117879]
  - smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-117879]
  - smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-117879]
  - smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-117879]
  - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-117879] {CVE-2025-39819}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114848] {CVE-2025-39751}
  - NFS: Fixup allocation flags for nfsiod's __GFP_NORETRY (Benjamin Coddington) [RHEL-116232]
  - xfs: make sure sb_fdblocks is non-negative (CKI Backport Bot) [RHEL-114540]
  - block: fix adding folio to bio (Ming Lei) [RHEL-96789]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.57.1.el9_6]
changelog:
  - NFSv4/flexfiles: Fix layout merge mirror check. (Benjamin Coddington) [RHEL-118731]
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113610] {CVE-2025-39730}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.58.1.el9_6]
changelog:
  - pstore/ram: Check start of empty przs during init (CKI Backport Bot) [RHEL-122067] {CVE-2023-53331}
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114299] {CVE-2025-39718}


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.22.1.rt14.307.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.22.1.rt14.307.el9_2 [2215122]
  - PCI: hv: Add a per-bus mutex state_lock (Vitaly Kuznetsov) [2217066 2182619]
  - Revert "PCI: hv: Fix a timing issue which causes kdump to fail occasionally" (Vitaly Kuznetsov) [2217066 2182619]
  - PCI: hv: Remove the useless hv_pcichild_state from struct hv_pci_dev (Vitaly Kuznetsov) [2217066 2182619]
  - PCI: hv: Fix a race condition in hv_irq_unmask() that can cause panic (Vitaly Kuznetsov) [2217066 2182619]
  - PCI: hv: Fix a race condition bug in hv_pci_query_relations() (Vitaly Kuznetsov) [2217066 2182619]
  - hwmon: (coretemp) avoid RDMSR interrupts to isolated CPUs (Marcelo Tosatti) [2215552 2182083]
  - prlimit: do_prlimit needs to have a speculation check (Alex Gladkov) [2215107 2196317] {CVE-2023-0458}
  - x86: don't use REP_GOOD or ERMS for small memory clearing (Myron Stowe) [2196230 2190487]
  - x86/cpufeatures: Add macros for Intel's new fast rep string features (Myron Stowe) [2196230 2190487]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.23.1.rt14.308.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.23.1.rt14.308.el9_2 [2215122]
  - KVM: x86: Don't inhibit APICv/AVIC if xAPIC ID mismatch is due to 32-bit ID (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Don't inhibit APICv/AVIC on xAPIC ID "change" if APIC is disabled (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: fix APICv/x2AVIC disabled when vm reboot by itself (Maxim Levitsky) [2218871 2177720]
  - locking/rwbase: Mitigate indefinite writer starvation (Eder Zulian) [2217939 2037670]
  - rbd: get snapshot context after exclusive lock is ensured to be held (Ilya Dryomov) [2216569 2212511]
  - rbd: move RBD_OBJ_FLAG_COPYUP_ENABLED flag setting (Ilya Dryomov) [2216569 2212511]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-284.24.1.rt14.309.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.24.1.rt14.309.el9_2 [2222796]
  - tracing/hwlat: Replace sched_setaffinity with set_cpus_allowed_ptr (Jerome Marchand) [2221157 2178234]
  - cifs: return a single-use cfid if we did not get a lease (Ronnie Sahlberg) [2221159 2175967]
  - cifs: Check the lease context if we actually got a lease (Ronnie Sahlberg) [2221159 2175967]
  - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir (Ronnie Sahlberg) [2221159 2175967]
  - cifs: use LIST_HEAD() and list_move() to simplify code (Ronnie Sahlberg) [2221159 2175967]
  - ipvlan:Fix out-of-bounds caused by unclear skb->cb (Davide Caratti) [2219662 2218677] {CVE-2023-3090}
  - nvme: fix discard support without oncs (Ming Lei) [2192632 2174443]
  - nvme: fix handling single range discard request (Ming Lei) [2192632 2174443]
  - KVM: x86/mmu: Refresh CR0.WP prior to checking for emulated permission faults (Paolo Bonzini) [2218935 2210042]
  - KVM: x86: Add helpers to query individual CR0/CR4 bits (Paolo Bonzini) [2218935 2210042]
  - KVM: x86: Preserve TDP MMU roots until they are explicitly invalidated (Paolo Bonzini) [2218935 2210042]
  - KVM: x86/mmu: Replace open coded usage of tdp_mmu_page with is_tdp_mmu_page() (Paolo Bonzini) [2218935 2210042]
  - KVM: x86/mmu: fix some comment typos (Paolo Bonzini) [2218935 2210042]
  - KVM: x86/mmu: Move TDP MMU VM init/uninit behind tdp_mmu_enabled (Paolo Bonzini) [2218935 2210042]
  - KVM: x86/mmu: Change tdp_mmu to a read-only parameter (Paolo Bonzini) [2218935 2210042]
  - KVM: VMX: Make CR0.WP a guest owned bit (Paolo Bonzini) [2218935 2210042]
  - KVM: x86: Make use of kvm_read_cr*_bits() when testing bits (Paolo Bonzini) [2218935 2210042]
  - KVM: x86: Ignore CR0.WP toggles in non-paging mode (Paolo Bonzini) [2218935 2210042]
  - KVM: x86: Do not unload MMU roots when only toggling CR0.WP with TDP enabled (Paolo Bonzini) [2218935 2210042]
  - erspan: get the proto with the md version for collect_md (Xin Long) [2217493 2140037]
  - net/sched: flower: fix possible OOB write in fl_set_geneve_opt() (Davide Caratti) [2216991 2214029] {CVE-2023-35788}
  - [redhat-rt] Update RTBZ for batch#3 (Patrick Talbert)


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-284.25.1.rt14.310.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.25.1.rt14.310.el9_2 [2222796]
  - x86/speculation: Allow enabling STIBP with legacy IBRS (Ricardo Robaina) [2215108 2187267] {CVE-2023-1998}
  - netfilter: nf_dup_netdev: add and use recursion counter (Eric Garver) [2221169 1724795]
  - netfilter: nf_dup_netdev: do not push mac header a second time (Eric Garver) [2221169 1724795]
  - netfilter: egress: silence egress hook lockdep splats (Eric Garver) [2221169 1724795]
  - netfilter: nft_fwd_netdev: Support egress hook (Eric Garver) [2221169 1724795]
  - netfilter: nft_meta: add NFT_META_IFTYPE (Eric Garver) [2221169 1724795]
  - KVM: x86: Allow APICv APIC ID inhibit to be cleared (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Track required APICv inhibits with variable, not callback (Maxim Levitsky) [2218871 2177720]
  - Revert "KVM: SVM: Do not throw warning when calling avic_vcpu_load on a running vcpu" (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Ignore writes to Remote Read Data on AVIC write traps (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Handle multiple logical targets in AVIC kick fastpath (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Require logical ID to be power-of-2 for AVIC entry (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Update svm->ldr_reg cache even if LDR is "bad" (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Always update local APIC on writes to logical dest register (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Inhibit AVIC if vCPUs are aliased in logical mode (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Inhibit APICv/AVIC if the optimized physical map is disabled (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Honor architectural behavior for aliased 8-bit APIC IDs (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Disable APIC logical map if vCPUs are aliased in logical mode (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Disable APIC logical map if logical ID covers multiple MDAs (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Skip redundant x2APIC logical mode optimized cluster setup (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Explicitly track all possibilities for APIC map's logical modes (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Explicitly skip optimized logical map setup if vCPU's LDR==0 (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Add helper to perform final AVIC "kick" of single vCPU (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Document that vCPU ID == APIC ID in AVIC kick fastpatch (Maxim Levitsky) [2218871 2177720]
  - Revert "KVM: SVM: Use target APIC ID to complete x2AVIC IRQs when possible" (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Fix x2APIC Logical ID calculation for avic_kick_target_vcpus_fast (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Compute dest based on sender's x2APIC status for AVIC kick (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Replace "avic_mode" enum with "x2avic_enabled" boolean (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Inhibit APIC memslot if x2APIC and AVIC are enabled (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Move APIC access page helper to common x86 code (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Handle APICv updates for APIC "mode" changes via request (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Don't put/load AVIC when setting virtual APIC mode (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Process ICR on AVIC IPI delivery failure due to invalid target (Maxim Levitsky) [2218871 2177720]
  - KVM: SVM: Flush the "current" TLB when activating AVIC (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Purge "highest ISR" cache when updating APICv state (Maxim Levitsky) [2218871 2177720]
  - KVM: x86: Blindly get current x2APIC reg value on "nodecode write" traps (Maxim Levitsky) [2218871 2177720]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.26.1.rt14.311.el9_2]
changelog:
  - net: openvswitch: fix upcall counter access before allocation (Eelco Chaudron) [2223310 2203263]
  - netfilter: nf_tables: prevent OOB access in nft_byteorder_eval (Florian Westphal) [2221736 2221737] {CVE-2023-35001}
  - netfilter: nf_tables: do not ignore genmask when looking up chain by id (Florian Westphal) [2221782 2221783] {CVE-2023-31248}
  - rtmutex: Ensure that the top waiter is always woken up (Joel Savitz) [2222121 2176147]
  - netfilter: nf_tables: unbind non-anonymous set if rule construction fails (Phil Sutter) [2216167 2214035] {CVE-2023-3390}
  - netfilter: nf_tables: add NFT_TRANS_PREPARE_ERROR to deal with bound set/chain (Phil Sutter) [2216167 2214035] {CVE-2023-3390}
  - netfilter: nf_tables: fix chain binding transaction logic (Phil Sutter) [2225461 2225462] {CVE-2023-3390 CVE-2023-3610}
  - netfilter: nf_tables: incorrect error path handling with NFT_MSG_NEWRULE (Phil Sutter) [2216167 2214035] {CVE-2023-3390}
  - netfilter: nf_tables: validate catch-all set elements (Florian Westphal) [2216167 2214035] {CVE-2023-3390}
  - thunderbolt: Increase DisplayPort Connection Manager handshake timeout (Desnes Nunes) [2219463 2168851]
  - thunderbolt: Increase timeout of DP OUT adapter handshake (Desnes Nunes) [2219463 2212495]
  - ASoC: Intel: sof_sdw: add quick for Dell SKU 0BDA (Jaroslav Kysela) [2218960 2217298]
  - ASoC: Intel: soc-acpi: add tables for Dell SKU 0B34 (Jaroslav Kysela) [2218960 2217298]
  - ASoC: Intel: sof-sdw: add Dell SKU 0B34 (Jaroslav Kysela) [2218960 2217298]
  - ASoC: Intel: soc-acpi: add table for RPL Dell SKU 0BDA (Jaroslav Kysela) [2218960 2217298]
  - ACPI: sleep: Avoid breaking S3 wakeup due to might_sleep() (Mark Langsdorf) [2218026 2215972]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.27.1.rt14.312.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.27.1.rt14.312.el9_2 [2228482]
  - x86/cpu/amd: Add a Zenbleed fix (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/cpu/amd: Move the errata checking functionality up (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/core: Return an error only when necessary (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/AMD: Fix mixed steppings support (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/AMD: Add a @cpu parameter to the reloading functions (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/amd: Remove load_microcode_amd()'s bsp parameter (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/amd: Cache debug register values in percpu variables (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode: Adjust late loading result reporting message (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode: Check CPU capabilities after late microcode update correctly (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode: Add a parameter to microcode_check() to store CPU capabilities (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/AMD: Rename a couple of functions (Waiman Long) [2226824 2226826] {CVE-2023-20593}
  - x86/microcode/AMD: Track patch allocation size explicitly (David Arcari) [2226821 1971938]
  - x86/microcode: Print previous version of microcode after reload (David Arcari) [2226821 1971938]
  - x86/cpu: Load microcode during restore_processor_state() (David Arcari) [2226821 1971938]
  - x86/pm: Add enumeration check before spec MSRs save/restore setup (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - x86/tsx: Add a feature bit for TSX control MSR support (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - x86/cpu: Restore AMD's DE_CFG MSR after resume (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - x86/pm: Fix false positive kmemleak report in msr_build_context() (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - x86/speculation: Restore speculation related MSRs during S3 resume (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - x86/pm: Save the MSR validity status at context setup (Chris von Recklinghausen) [2226821 2181908] {CVE-2023-1637}
  - libceph: harden msgr2.1 frame segment length checks (Ilya Dryomov) [2227070 2222253]
  - seccomp: Move copy_seccomp() to no failure path. (Viktor Malik) [2226945 2218682]
  - bpf: Adjust insufficient default bpf_jit_limit (Viktor Malik) [2226945 2218682]
  - crypto: ccp: Get rid of __sev_platform_init_locked()'s local function pointer (Bandan Das) [2224587 2152249]
  - crypto: ccp - Name -1 return value as SEV_RET_NO_FW_CALL (Bandan Das) [2224587 2152249]
  - x86/sev: Change snp_guest_issue_request()'s fw_err argument (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Double-buffer messages (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Add throttling awareness (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Convert the sw_exit_info_2 checking to a switch-case (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Do some code style cleanups (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Carve out the request issuing logic into a helper (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Remove the disable_vmpck label in handle_guest_request() (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Simplify extended guest request handling (Bandan Das) [2224587 2152249]
  - virt/coco/sev-guest: Check SEV_SNP attribute at probe time (Bandan Das) [2224587 2152249]
  - virt/sev-guest: Return -EIO if certificate buffer is not large enough (Bandan Das) [2224587 2152249]
  - virt/sev-guest: Prevent IV reuse in the SNP guest driver (Bandan Das) [2224587 2152249]
  - x86/sev: Don't use cc_platform_has() for early SEV-SNP calls (Bandan Das) [2224587 2152249]
  - [redhat-rt] Update RTBZ for batch#3 (Herton R. Krzesinski)


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.28.1.rt14.313.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.28.1.rt14.313.el9_2 [2228482]
  - iavf: fix reset task race with iavf_remove() (Petr Oros) [2228156 2223599]
  - iavf: fix a deadlock caused by rtnl and driver's lock circular dependencies (Petr Oros) [2228156 2223599]
  - Revert "iavf: Do not restart Tx queues after reset task failure" (Petr Oros) [2228156 2223599]
  - Revert "iavf: Detach device during reset task" (Petr Oros) [2228156 2223599]
  - iavf: Wait for reset in callbacks which trigger it (Petr Oros) [2228156 2223599]
  - iavf: use internal state to free traffic IRQs (Petr Oros) [2228156 2223599]
  - iavf: Fix out-of-bounds when setting channels on remove (Petr Oros) [2228156 2223599]
  - iavf: Fix use-after-free in free_netdev (Petr Oros) [2228156 2223599]
  - iavf: make functions static where possible (Petr Oros) [2228156 2223599]
  - iavf: fix err handling for MAC replace (Petr Oros) [2228156 2223599]
  - iavf: remove some unused functions and pointless wrappers (Petr Oros) [2228156 2223599]
  - iavf: remove mask from iavf_irq_enable_queues() (Petr Oros) [2228156 2223599]
  - iavf: send VLAN offloading caps once after VFR (Petr Oros) [2228156 2223599]
  - i40e: Wait for pending VF reset in VF set callbacks (Ivan Vecera) [2228158 2215498]
  - i40e: Add helper for VF inited state check with timeout (Ivan Vecera) [2228158 2215498]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [2227768 2223719]
  - locking/rtmutex: Add a lockdep assert to catch potential nested blocking (Crystal Wood) [2225623 2218724]
  - locking/rtmutex: Avoid pointless blk_flush_plug() invocations (Crystal Wood) [2225623 2218724]
  - locking/rtmutex: Submit/resume work explicitly before/after blocking (Crystal Wood) [2225623 2218724]
  - sched/core: Provide sched_rtmutex() and expose sched work helpers (Crystal Wood) [2225623 2218724]
  - cpufreq: intel_pstate: Enable HWP IO boost for all servers (David Arcari) [2210270 2175626]


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.29.1.rt14.314.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.29.1.rt14.314.el9_2 [2228482]
  - redhat: configs: Disable CONFIG_CRYPTO_STATS since performance issue for storage (Herbert Xu) [2231850 2227964]
  - i2c: tegra: Fix PEC support for SMBUS block read (Steve Best) [2230488 2214531]
  - i2c: tegra: Set ACPI node as primary fwnode (Steve Best) [2230483 2222101]
  - perf vendor events intel: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf vendor events intel: Refresh sapphirerapids metrics and events (Michael Petlan) [2230175 2177180]
  - perf vendor events: Update Intel sapphirerapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel/cstate: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/intel/uncore: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/msr: Add Emerald Rapids (Michael Petlan) [2230175 2177180]
  - perf/x86/rapl: Add support for Intel Emerald Rapids (Michael Petlan) [2230175 2177180]
  - platform/x86: intel-uncore-freq: add Emerald Rapids support (Michael Petlan) [2230169 2156827]
  - netfilter: nf_tables: disallow rule addition to bound chain via NFTA_RULE_CHAIN_ID (Phil Sutter) [2228992 2228993] {CVE-2023-4147}
  - netfilter: nft_set_pipapo: fix improper element removal (Phil Sutter) [2227518 2227519] {CVE-2023-4004}


author: Herton R. Krzesinski <herton@redhat.com> [5.14.0-284.30.1.rt14.315.el9_2]
changelog:
  - [rt] build kernel-rt-5.14.0-284.30.1.rt14.315.el9_2 [2228482]
  - sched/core: Add __always_inline to schedule_loop() (Crystal Wood) [2233928 2232098]
  - x86/sev: Do not try to parse for the CC blob on non-AMD hardware (Tao Liu) [2232700 2182562]
  - arm64: efi: Make efi_rt_lock a raw_spinlock (Mark Salter) [2213502 2213503] {CVE-2023-21102}
  - efi: rt-wrapper: Add missing include (Mark Salter) [2213502 2213503] {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack (Mark Salter) [2213502 2213503] {CVE-2023-21102}
  - crypto: rng - Fix lock imbalance in crypto_del_rng (Herbert Xu) [2232213 2229643]
  - drm/ast: Fix ARM compatibility (Robert Foss) [2232302 2192980]
  - irqchip/gicv3: Workaround for NVIDIA erratum T241-FABRIC-4 (Mark Salter) [2231962 2179060]
  - genirq: GENERIC_IRQ_EFFECTIVE_AFF_MASK depends on SMP (Mark Salter) [2231962 2179060]
  - scsi: storvsc: Handle SRB status value 0x30 (Cathy Avery) [2231990 2224933]
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts (Cathy Avery) [2230747 2228298]
  - dm cache policy smq: ensure IO doesn't prevent cleaner policy progress (Benjamin Marzinski) [2228481 2159623]
  - net/sched: cls_fw: Fix improper refcount update leads to use-after-free (Davide Caratti) [2225654 2225655] {CVE-2023-3776}
  - md: add error_handlers for raid0 and linear (Nigel Croxon) [2221170 2162219]
  - [redhat-rt] changelog: do not perform an empty Bugzilla query (Luis Claudio R. Goncalves)


author: Clark Williams <williams@redhat.com> - 2.5-1
changelog:
  - remove strip of realtime-entsk and generate debuginfo
  - ensure all files have valid SPDX license identifiers
  - remove Red Hat Makefile targets and specfile
  - Makefile cleanups and added .gitignore
  - drop the 'v' in the version string for the tarball
  - Makefile: add options for passing annocheck
  - Bump version to 2.5
  Resolves: RHEL-30179


author: Anubhav Shelat <ashelat@redhat.com> - 3.8-3
changelog:
  - Allow rteval to search /usr/bin/ for sysreport
  - Convert base64 data to text before wrapping.
  - Add sysreport to gating tests and check the exit status.
  Resolves: RHEL-44437


author: John Kacur <jkacur@redhat.com> - 3.8-4
changelog:
  - Add timerlat tracing
  - Add Fix -aNone being passed to cyclictest
  - Add rtla as a requires for timerlat
  Resolves: RHEL-35461


author: Crystal Wood <crwood@redhat.com> - 3.8-5
changelog:
  - Prevent using cyclictest and timerlat and the same time
  - Add a --noload option
  - Switch to autosetup, picking up the updates that should have been in 3.8-4
  Resolves: RHEL-35506
  Resolves: RHEL-50323


author: Anubhav Shelat <ashelat@redhat.com> - 3.8-6
changelog:
  - Add functionality to allow user to execute cpupower tool to
  set idle state depth  while running rteval.
  - Disable latency trick by using --default-system option with
  cyclictest when setting idle state depth.
  Resolves: RHEL-37645


author: John Kacur <jkacur@redhat.com> - 3.9-3
changelog:
  - Make the default interval for timerlat in rteval 1100us
  - Make cyclictest the default measurement module for rteval
  Resolves: RHEL-78394


author: John Kacur <jkacur@redhat.com> - 1.6-3
changelog:
  - Upgrade the gating tests to match the kernel version in rteval-loads
  Resolves: rhbz#2166356
  jiraProject == RHELPLAN-147319


author: John Kacur <jkacur@redhat.com> - 1.6-4
changelog:
  - Upgrade the the kernel to linux-6.6.1
  - Make the gating tests match the correct kernel version
  Resolves: RHEL-14482


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-17121
    - print all arguments of failing commands in error messages
      resolves: RHEL-3689
    - plugin_sysctl: added support for sysctl names with slash
      resolves: RHEL-3707
    - tuned-adm: added support for moving devices between plugin instances
      resolves: RHEL-15141
    - api: added methods for retrieval of plugin instances and devices
      resolves: RHEL-15137
    - plugin_cpu: amd-pstate mentioned instead of just intel_pstate
      resolves: RHEL-16469
    - hotplug: do not report ENOENT errors on device remove
      resolves: RHEL-11342
    - plugin_sysctl: expand variables when reporting overrides
      resolves: RHEL-18972
    - plugin_acpi: new plugin which handles ACPI platform_profile
      resolves: RHEL-16966
    - plugin_bootloader: skip calling rpm-ostree kargs in no-op case
      resolves: RHEL-20767
    - plugin_cpu: support cstate settings of pm_qos_resume_latency_us
      resolves: RHEL-21129
    - scheduler: add option for ignoring IRQs affinity
      resolves: RHEL-21923
    - plugin_intel_uncore: new plugin for uncore setting


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.22.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-17121
    - renamed intel_uncore plugin to uncore
    - network-throughput: increased net.ipv4.tcp_rmem default value
      resolves: RHEL-25847


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-50568
    - spec: create /etc/tuned/profiles directory
    - hotplug: wait for device initialization
    - sap-netweaver: increased vm.max_map_count
      resolves: RHEL-31757
    - daemon: buffer sighup signal
      resolves: RHEL-31180
    - added an option to configure profile directories
      resolves: RHEL-26157
    - api: added commands to dynamically create/destroy instances
    - functions: added 'intel_recommended_pstate'
    - functions: added 'log' which helps with debugging
    - functions: added 'package2cpus' and 'packages2uncores' matchers
    - functions: added 'lscpu' to list CPU details
    - plugins: added plugin_irq
    - plugin_video: added support for amdgpu `panel_power_savings` attribute
    - plugin_cpu: check that writes are necessary if they may cause redundant IPIs
      resolves: RHEL-25613
    - plugin_uncore: allow to configure frequency limits using percent
    - amd-pstate: added support for controlling core performance boost
    - plugin_scheduler: adjusted error logging in _set_affinity
      resolves: RHEL-46560
    - plugin_audio: enabled controller reset to fix suspend with NVIDIA
    - plugin_irq: fixed expansion of variables
    - plugin_irqbalance: switched to IRQBALANCE_BANNED_CPULIST


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-0.2.rc1
changelog:
  - fixed functions packaging and added explicit conflict with power-profiles-daemon
    related: RHEL-50568


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-50568
    - clear plugin repository when stopping tuning
    - man: add description of the balanced-battery profile


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.24.0-2
changelog:
  - Fixed privileged execution of arbitrary scripts by active local user,
    (CVE-2024-52336)
    Resolves: RHEL-66638
  - Added sanity checks for API methods parameters, (CVE-2024-52337)
    Resolves: RHEL-66615


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-0.1.rc1
changelog:
  - new release
    - rebased tuned to latest upstream
      resolves: RHEL-70457
    - tuned-ppd: removed the use of StrEnum
    - tuned-ppd: fixed traceback
    - tuned-ppd: multiple fixes and updates
    - docs: plugins docs are now automatically generated from the docstrings
    - plugin_cpu: fixed no_turbo boolean option parsing
      resolves: RHEL-51760
    - plugin_cpu: allowed raw energy_performance_preference values
    - plugin_vm: added support for dirty_(bytes|ratio) sysctl parameters
      resolves: RHEL-58820
    - plugin_bootloader: added variables to BLS entries only if grub is used
    - plugin_scheduler: do not assume that perf events have type attribute
    - plugin_scheduler: updated sched knobs for kernels 6.6+
    - plugin_scheduler: log process info when its affinity cannot be changed
    - plugin_scheduler: postpone cgroup blacklist check, double-check after fail
      resolves: RHEL-72981
    - plugin_scheduler: made perf support optional
    - plugin_net: added support for hotplug and rename
      resolves: RHEL-60906
    - makefile: added support for installation to custom $BINDIR/$SBINDIR
    - functions: dropped cpuspeed support


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.0-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - sap-hana: Set transparent_hugepages to madvise
    - plugin_bootloader: export Grub variables to make them available in submenus
    - utils.commands: fixed CPU online detection when not present
    - plugin_net: handled cqe-mode-rx ethtool option
    - profiles: correct CPU governor settings


author: Jaroslav Škarvada <jskarvad@redhat.com> - 2.25.1-1
changelog:
  - new release
    - rebased tuned to latest upstream
      related: RHEL-70457
    - plugins: added missing instance parameters
    - disk: added missing remove parameter
    - plugin_scheduler: added switch to disable processing of kthreads
    - Makefile: added support for installation to custom LIBEXECDIR
    - functions: create a new parser object for each string expansion
      resolves: RHEL-75773


