# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.46.1.el8_10]
changelog:
  - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934]
  - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934]
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832]
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785}
  - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.47.1.el8_10]
changelog:
  - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136]
  - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156]
  - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.48.1.el8_10]
changelog:
  - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves)
  - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208]
  - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208]
  - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208]
  - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.49.1.el8_10]
changelog:
  - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244]
  - redhat: drop Y issues from changelog (Jan Stancek)
  - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673]
  - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673]
  - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673]
  - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673]
  - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673]
  - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499]
  - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
  - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.50.1.el8_10]
changelog:
  - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119]
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150}
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052]
  - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852]
  - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852]
  - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.51.1.el8_10]
changelog:
  - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072]
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.52.1.el8_10.gfd1b]
changelog:
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141}
  - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285]
  - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266]
  - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266]
  - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266]
  - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266]
  - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342]
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011}


author: Andrei Lukoshko <alukoshko@almalinux.org> - 4.18.0-553.52.1
changelog:
  - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
  - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
  - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla4xxx: bring back deprecated PCI ids
  - lpfc: bring back deprecated PCI ids
  - be2iscsi: bring back deprecated PCI ids
  - kernel/rh_messages.h: enable all disabled pci devices by moving to
    unmaintained


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.52.1.lve.el8_10]
changelog:
  - CLKRN-1855: aacraid: add bug_on to catch fibs list corruptions earlier
  - CLKRN-1786: carefully stop the command thread in aacraid
  - CLKRN-1769: call raid5_quiesce after suspending the md device
  - CLKRN-1683: do not lock up during fdinfo output
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els5]
changelog:
  - af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
  - netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
  - libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
  - bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
  - ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
  - ima: define ima_max_digest_data struct without a flexible array variable
  - ima: detect changes to the backing overlay file
  - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command {CVE-2023-6546}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
  - netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
  - Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
  - tipc: fix UAF in error path {CVE-2024-36886}
  - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
  - net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
  - net/mlx5e: Introduce flow steering API {CVE-2024-27014}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
  - platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
  - fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
  - wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
  - RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
  - wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
  - wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
  - RDMA/siw: Fix connection failure handling {CVE-2023-52513}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
  - sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
  - memcg: enable accounting for file lock caches {CVE-2022-0480}
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
  - ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
  - vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
  - hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
  - i2c: Fix a potential use after free {CVE-2019-25162}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump {CVE-2024-26615}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els6]
changelog:
  - tun: add missing verification for short frame {CVE-2024-41091}
  - tap: add missing verification for short frame {CVE-2024-41090}
  - drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
  - net: fix __dst_negative_advice() race {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
  - net: fix out-of-bounds access in ops_init {CVE-2024-36883}
  - net/sched: flower: Fix chain template offload {CVE-2024-26669}
  - netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
  - netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
  - netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
  - netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
  - netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
  - wait: add wake_up_pollfree() {CVE-2023-52707}
  - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
  - netfilter: complete validation of user input {CVE-2024-35962}
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
  - netfilter: validate user input for expected length {CVE-2024-35896}
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
  - bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
  - drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
  - gro: fix ownership transfer {CVE-2024-35890}
  - mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
  - wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
  - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
  - drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
  - i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
  - vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
  - ata: libata-core: Fix double free on error {CVE-2024-41087}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
  - tcp_metrics: validate source addr length {CVE-2024-42154}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els7]
changelog:
  - tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
  - dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
  - scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
  - ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
  - block/ioctl: prefer different overflow check {CVE-2024-41000}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
  - net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
  - nvme: avoid double free special payload {CVE-2024-41073}
  - x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
  - x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - objtool: Add entry UNRET validation {CVE-2024-25744}
  - x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
  - init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
  - gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
  - gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
  - drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
  - net/mlx5: Discard command completions in internal error {CVE-2024-38555}
  - net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
  - perf/core: Fix potential NULL deref {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els8]
changelog:
  - drm/amd/pm: Fix negative array index read {CVE-2024-46821}
  - drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
  - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
  - drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
  - Squashfs: sanity check symbolic link size {CVE-2024-46744}
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
  - netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
  - netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
  - bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
  - mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
  - cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
  - timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() {CVE-2023-4133}
  - timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode {CVE-2023-4133}
  - timers: Silently ignore timers with a NULL function {CVE-2023-4133}
  - timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
  - timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
  - timers: Use del_timer_sync() even on UP {CVE-2023-4133}
  - timers: Update kernel-doc for various functions {CVE-2023-4133}
  - timers: Replace BUG_ON()s {CVE-2023-4133}
  - timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
  - ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
  - igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
  - igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
  - nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
  - x86: stop playing stack games in profile_pc() {CVE-2024-42096}
  - xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
  - NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
  - ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
  - sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
  - tipc: force a dst refcount before doing decryption {CVE-2024-40983}
  - scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
  - xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
  - ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
  - usb-storage: alauda: Check whether the media is initialized {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() {CVE-2024-38619}
  - crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
  - wifi: nl80211: don't free NULL coalescing rule {CVE-2024-36941}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() {CVE-2024-36025}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() {CVE-2024-35898}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work {CVE-2024-35852}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination {CVE-2024-35845}
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes {CVE-2024-35789}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work {CVE-2024-27052}
  - nfp: flower: handle acti_netdevs allocation failure {CVE-2024-27046}
  - octeontx2-af: Use separate handlers for interrupts {CVE-2024-27030}
  - netfilter: flowtable: validate pppoe header {CVE-2024-27016}
  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address {CVE-2024-26946}
  - scsi: qla2xxx: Fix command flush on cable pull {CVE-2024-26931}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel {CVE-2024-26737}
  - Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself {CVE-2023-52735}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() {CVE-2023-52651}
  - net: tap_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - net: tun_chr_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - seg6: fix the iif in the IPv6 socket control block {CVE-2021-47515}
  - tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes {CVE-2024-46759}
  - net: bridge: mst: fix vlan use-after-free {CVE-2024-36979}
  - stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk {CVE-2024-46743}
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup {CVE-2024-46747}
  - drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
  - drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
  - wifi: nl80211: Avoid address calculations via out of bounds array indexing {CVE-2024-38562}
  - wifi: nl80211: convert cfg80211_scan_request allocation to *_size macros {CVE-2024-38562}
  - overflow: Implement size_t saturating arithmetic helpers {CVE-2024-38562}
  - cdrom: rearrange last_media_change check to avoid unintentional overflow {CVE-2024-42136}
  - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
  - drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
  - sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
  - firmware: cs_dsp: Fix overflow checking of wmfw header {CVE-2024-41039}
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
  - HID: amd_sfh: free driver_data after destroying hid device {CVE-2024-46746}
  - xfs: don't walk off the end of a directory data block {CVE-2024-41013}
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
  - tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
  - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
  - drm/amdgpu/mes: fix mes ring buffer overflow {CVE-2024-46700}
  - exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
  - PCI/MSI: Fix UAF in msi_capability_init {CVE-2024-41096}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els9]
changelog:
  - smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
  - smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
  - cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
  - cifs: return a single-use cfid if we did not get a lease {CVE-2023-52751}
  - cifs: Check the lease context if we actually got a lease {CVE-2023-52751}
  - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir {CVE-2023-52751}
  - cifs: use LIST_HEAD() and list_move() to simplify code {CVE-2023-52751}
  - cifs: fix wrong unlock before return from cifs_tree_connect() {CVE-2023-52751}
  - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
  - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
  - smb: client: fix UAF in async decryption {CVE-2024-50047}
  - smb3: rename encryption/decryption TFMs
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
  - driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
  - drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
  - ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
  - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
  - mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
  - filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
  - drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
  - ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
  - slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
  - ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
  - ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
  - tipc: guard against string buffer overrun {CVE-2024-49995}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
  - firmware_loader: Block path traversal {CVE-2024-47742}
  - ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
  - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
  - wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
  - net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
  - drm/amdgpu: Validate TA binary size {CVE-2024-44977}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els10]
changelog:
  - smb: client: fix use-after-free of signing key {CVE-2024-53179}
  - smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
  - smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
  - cifs: return correct error in ->calc_signature() {CVE-2024-53179}
  - cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
  - cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
  - xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
  - scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
  - EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
  - net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
  - initramfs: avoid filename buffer overrun {CVE-2024-53142}
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
  - Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
  - Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
  - blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
  - net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
  - net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
  - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
  - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
  - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
  - cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
  - Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
  - PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
  - PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
  - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
  - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
  - memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
  - Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
  - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
  - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
  - smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
  - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
  - x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
  - bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
  - media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2024-27043}
  - media: dvbdev: fix build warning due to comments {CVE-2024-27043}
  - media: dvbdev: adopts refcnt to avoid UAF {CVE-2024-27043}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els11]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format {CVE-2024-53104}
  - ALSA: 6fire: Release resources at card release {CVE-2024-53239}
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches {CVE-2024-26885}
  - bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' {CVE-2024-27045}
  - af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
  - cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
  - arm64: hibernate: Fix level3 translation fault in swsusp_save() {CVE-2024-26989}
  - perf: hisi: Fix use-after-free when register pmu fails {CVE-2023-52859}
  - nbd: fix uaf in nbd_open {CVE-2023-52837}
  - ring-buffer: Do not attempt to read past "commit" {CVE-2023-52501}
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) {CVE-2023-52637}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
  - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
  - pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
  - irqchip/gic-v3-its: Prevent double free on error {CVE-2024-35847}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
  - nfs: fix UAF in direct writes {CVE-2024-26958}
  - of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679}
  - ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els12]
changelog:
  - spec: update shim Conflicts, Provides keys
  - HID: core: zero-initialize the report buffer {CVE-2024-50302}
  - net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
  - bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
  - net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
  - parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
  - udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
  - security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
  - usb: typec: altmode should keep reference to parent {CVE-2024-50150}
  - dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
  - smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
  - net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
  - USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
  - tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
  - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
  - NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
  - NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
  - efi: rt-wrapper: Add missing include {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack {CVE-2023-21102}
  - mptcp: refactor passive socket initialization {CVE-2024-26782}
  - mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
  - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
  - smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
  - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
  - smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
  - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
  - smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
  - bpf: Protect against int overflow for stack access size {CVE-2024-35905}
  - bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
  - devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
  - ionic: fix use after netif_napi_del() {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
  - vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
  - raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
  - md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
  - drm/amdgpu: fix usage slab after free {CVE-2024-56551}
  - drm/amd: Use `amdgpu_ucode_*` helpers for GPU info bin {CVE-2024-56551}
  - drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
  - drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
  - drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments {CVE-2023-52812}
  - drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
  - drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
  - drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
  - drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
  - drm/amd: Move helper for dynamic speed switch check out of smu13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 {CVE-2023-52812}
  - drm/amd/pm: share the code around SMU13 pcie parameters update {CVE-2023-52812}
  - drm: zynqmp_kms: Unplug DRM device before removal {CVE-2024-56538}
  - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt {CVE-2023-52854}
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
  - drm/dp_mst: Skip CSN if topology probing is not done yet {CVE-2024-57798}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els13]
changelog:
  - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
  - wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
  - cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
  - veth: Fix use after free in XDP_REDIRECT {CVE-2023-53107}
  - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
  - arm64/sve: Discard stale CPU state when handling SVE traps {CVE-2024-50275}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() {CVE-2024-26892}
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read {CVE-2024-58069}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() {CVE-2025-21702}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
  - vlan: enforce underlying device type {CVE-2025-21920}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
  - watch_queue: Actually free the watch {CVE-2022-49256}
  - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
  - netfilter: nf_set_pipapo: fix initial map fill {CVE-2024-57947}
  - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations {CVE-2021-47098}
  - aio: fix use-after-free due to missing POLLFREE handling {CVE-2021-47505}
  - aio: keep poll requests on waitqueue until completed {CVE-2021-47505}
  - smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
  - cifs: remove useless DeleteMidQEntry() {CVE-2023-52757}
  - media: uvcvideo: Remove dangling pointers {CVE-2024-58002}
  - media: uvcvideo: Only save async fh if success {CVE-2024-58002}
  - media: uvcvideo: Refactor iterators {CVE-2024-58002}
  - drm: nv04: Fix out of bounds access {CVE-2024-27008}
  - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785}
  - net: rose: fix timer races against user threads {CVE-2025-21718}
  - media: uvcvideo: Fix double free in error path {CVE-2024-57980}
  - vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
  - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
  - afs: Increase buffer size in afs_update_volume_status() {CVE-2024-26736}
  - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
  - bpf: Check validity of link->type in bpf_link_show_fdinfo() {CVE-2024-53099}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-37
changelog:
  - CLKRN-1698: disable write access to process memory via procfs
  - CLKRN-1688: CL9.5 kernel support
  - CLKRN-1685: implement iolimits for LVP


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-38
changelog:
  - CLKRN-1701: implement namespace check in __ptrace_may_access
  - CLKRN-1696: a switch to disable page cache accounting in lve pmem


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-41
changelog:
  - CLKRN-1717: enable lve_pmem_nocache by default
  - CLKRN-1716: adapted SP hooks variants for Ubuntu 22
  - CLKRN-1715: adapt datacycle hook for Ubuntu 22
  - CLKRN-1715: adapted XFS quota flag for Ubuntu 22 kernel (5.15.0)


author: Vadim Panov <vpanov@cloudlinux.com> - 17:9.0.0-1
changelog:
  - Initial minimal qemu-guest-agent spec file
  - Using QEMU 9.0.0 for glib 2.56.4 compatibility
  - Added patch to skip bind mounts in fs list to avoid fsFreeze failures


