# changelog

author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-28
changelog:
  - Implement automatical creation of missed /var/clwpos/uids/UID directories for all users (CLPRO-2491)
  - Fix cloudlinux-awp-user get/enable/disable does not work with ftp user on Plesk (CLPRO-2602)
  - Fix AWP check conflicting PHP module on FS instead PHP loaded modules (CLPRO-1952)


author: Roman Krompets <rkrompets@cloudlinux.com> - 1.9-30
changelog:
  - Unbind accelerate-wp from X-Ray (CLPRO-2201)
  - Fix redis to become inactive after clonning WP site with create a new domain (CLPRO-2670)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-32
changelog:
  - Prevent UnicodeDecodeError when parsing wp-cli output (CLPRO-1288)
  - Fix php version could not be obtained due to extra slash in docroot (CLPRO-1884)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-33
changelog:
  - Remove SmartAdvice plugin after disabling AWP in WHM (CLPRO-775)
  - Fix the cloudlinux-awp-user get unility for case when features are hidden (CLPRO-2694)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-34
changelog:
  - Analyze and fix issues reported by sentry event "Documentroot s is missing in user information" (CLPRO-2018)
  - Implemented hooks on WP sites cloning for sync AccelerateWP modules with original website (CLPRO-2678)
  - Fixed conflict between redis and alt-redis (CLPRO-2751)
  - Fix failure when website in the Multisite mode with the plugin status "active-network" (CLPRO-2750)
  - Update wp cli to version 2.12.0 (CLPRO-1281)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-36
changelog:
  - Refactored Critical CSS module for WP2 to improve availability (CLPRO-2782)
  - Add display_error=1 in wp-cli-wrapped to simplify troubleshooting (CLPRO-2630)


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.10-1
changelog:
  - Improve installation of redis and other PHP extension needed for AccelerateWP (CLPRO-2127)
  - Added MAx Cache cli commands (MAXWS-926)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 1.10-2
changelog:
  - AWP set-suite take too long due to daemon-reload (CLPRO-2925)
  - Avoid saving unnecessary WordPress backup files when activating Redis Object Cache (Synced from 1.9-39)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.10-5
changelog:
  - CLPRO-3045: Improved Redis configuration generation, daemon communication, and upgrade task handling


author:
  Ruslan Koliada <rkoliada@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1.10-8

changelog:
  - CLPRO-3177: Reliability and robustness improvements in AccelerateWP utilities and helper scripts
  - CLOS-4494: Fix enable_redis_for_alt_php.py crash when an alt-php directory has no PHP binary


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.10-9
changelog:
  - CLPRO-3147: Fault-tolerance and edge-case handling fixes in AccelerateWP
  - CLPRO-3204: Stability and code-quality enhancements across the AccelerateWP daemon, CLI, and supporting scripts
  - CLPRO-3237: Robustness and reliability improvements across the AccelerateWP daemon, CLI, and helper scripts


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 1.10-10
changelog:
  - CLPRO-3351: Recover AccelerateWP daemon from boot-time socket failures and report daemon unavailability instead of misleading incompatibility errors
  - CLPRO-3328: Reliability, robustness, and resource-handling improvements across the AccelerateWP daemon, CLI, hooks, and helper scripts


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.8-4
changelog:
  - Fix sending sentry events on empty scanning report status (CLPRO-1334)
  - Fix AccelerateWP activation fails on users with disk quota exceeded (CLPRO-781)
  - Setup xray-user-agent if AccelerateWP is enabled (CLPRO-730)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-1
changelog:
  - Implement DirectAdmin support to AccelerateWP (CLPRO-1395, CLPRO-1403)
  - Add --skip-dns-check options to ignore site resolving results (CLPRO-1422)
  - Speed up enabling AccelerateWP feature (CLPRO-1423)
  - Add AccelerateWP feature-flags into new metrics discovery system (CLPRO-1282)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-2
changelog:
  - Fix wp-cli commands fail on installed 3rd WordPress plugins (CLPRO-1379)
  - Fix getting php version via clwpos_monitoring daemon (CLPRO-1490)
  - Fix broken utilities output due to syslog configuration (CLPRO-1491)


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-3
changelog:
  - Improve selection of required PHP extensions in WP CLI wrapper script (CLPRO-1431)
  - Disable open_basedir restrictions for WP-CLI wrapper script (CLPRO-1525)
  - Improved handling of broken sites in WP CLI wrapper script (CLPRO-1468, CLPRO-1478)


author: alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-4
changelog:
  - Add new types of incompatibilities on website scanning (CLPRO-1544)
  - Improve error reporting in WP CLI wrapper (CLPRO-1558)


author: Daniil Danilkin <ddanilkin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-5
changelog:
  - Fix clwpos CLI errors if WordPress version.php is missing (CLPRO-1430)
  - Improve error reporting in WP CLI wrapper (CLPRO-1594)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-6
changelog:
  - Add user syncing on --allowed-for-all option (CLPRO-1608)
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Activating AccelerateWP via Plesk extension for users with multiple subscriptions (CLPRO-1643)
  - Manage configs same way across all CloudLinux Editions (CLPRO-1658)
  - Fix disk quota exceeded issue on creating user .clwpos directory (CLPRO-1666)


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-7

changelog:
  - Activating AccelerateWP via Plesk extension for users with multiple subscriptions (CLPRO-1643, CLPRO-1668)
  - Activating AccelerateWP on requests from WHMCS (CLPRO-1694)
  - Unify suites defaults across all editions (CLPRO-1657)
  - Update website incompatibilities when AWP daemon is not running (CLPRO-1689)
  - Fix the way of returning the WP CLI wrapper value (CLPRO-1744)
  - Add ability to make suite visible per user (CLPRO-1746)
  - Backup AccelerateWP configs on activation via WHMCS (CLPRO-1768)
  - Send analytics on allow suite from WHMCS (CLPRO-1738)
  - Extend Plesk Extension with new methods (CLPRO-1733)
  - Add more logs to analyze "'int' object is not iterable" sentry issue (CLPRO-1739)
  - Fix get-stat not accounting default states of suites (CLPRO-1781)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-8
changelog:
  - CLN sync - log list of affected unique_ids when authentication fails (CLPRO-1709)
  - Automatic installation and update the extension for Plesk for interaction of the CloudLinux Advantage WHMCS addon with AccelerateWP commands (CLPRO-1731)
  - Fix backup AccelerateWP configs (CLPRO-1882)


author: alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 1.9-9
changelog:
  - Automatically uninstall SmartAdvice plugins and turn off notifications if they were enabled automatically (CLPRO-1926)
  - Added option to disable SmartAdvice WordPress plugins (CLPRO-1924)
  - Added Smart Advice plugin installation metric to statistics (CLPRO-1928)
  - Make set-suite command process multiple users (CLPRO-1902)
  - Added restore AccelerateWP backup command (CLPRO-1852)
  - Turn off AccelerateWP suites during erase of AccelerateWP (CLPRO-1915)


author: alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 1.9-10
changelog:
  - Fix tracebacks when control panel returns controversial information about user (CLPRO-1898, CLPRO-1843)
  - Fix alt-php redis configurator to consider msgpack extension (CLPRO-1958)
  - Fix clwpos_collect_information script to create needed directory (CLPRO-1897)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-11

changelog:
  - Add support of translations in AccelerateWP (CLPRO-1858)
  - Add whmcs statistics endpoint in cloudlinux-awp-admin tool
  - The execution of commands for interaction with WHMCS has been accelerated. Restoring backups from WHMCS for server settings only. Added deprecated status for backup folders. (CLPRO-1905, CLPRO-1994)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-11

changelog:
  - Add support of translations in AccelerateWP (CLPRO-1858)
  - Add whmcs statistics endpoint in cloudlinux-awp-admin tool (CLPRO-2005)
  - Improved backup recovery for WHMCS, added commands to Plesk extension (CLPRO-1905, CLPRO-1994)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> - 1.9-13
changelog:
  - Disable error logging when running wp-cli (CLPRO-1779)
  - Fix inability to turn off smart advice notification during yum transaction with no license (CLRPO-2026)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-18
changelog:
  - Fix sending empty report with AccelerateWP features to CLN (CLPRO-2239)
  - Make AccelerateWP Premium Object Cache free (CLPRO-2279, CLPRO-2281)
  - Fix AccelrateWP port create user hook for reseller user (CLPRO-2091)
  - Fix folder with AccelrateWP backup folder not found (CLPRO-2266)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-20
changelog:
  - Remove legacy "source" key from configs (CLPRO-2268)
  - Fix restoring Object Cache feature upon AccelerateWP Premium suite activation (CLPRO-2041)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-21
changelog:
  - Fix redis is unreachable when enabling Object Cache feature (CLPRO-2243)
  - Fix removing AccelerateWP hooks upon package removal (CLPRO-2293)
  - Fix AccelerateWP end-user info loading when wp-cli is malformed for site (CLPRO-1845)


author: alutsiuk <alutsiuk@cloudlinux.com> - 1.9-22
changelog:
  - Add caching for getting supported suites by license (CLPRO-2339)
  - Fix redis processes are not started after reboot (CLPRO-1667)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-23
changelog:
  - Improved wp-cli commands work with WordPress sites (CLPRO-2478)
  - Fix AccelerateWP suite activation slows down account creation (CLPRO-2446)


author: Yehor Komarov <ykomarov@cloudlinux.com> - 1.9-25
changelog:
  - Fix BytesWarning: str() on a bytes instance issue in collect_information script (CLPRO-2244)
  - Added support for Ubuntu 22 (CLPRO-2533)


author: alutsiuk <alutsiuk@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 1.9-26
changelog:
  - Implement all features deactivation for all user websites (CLPRO-2562)
  - Fix getting user owner for ftp users on Plesk (CLPRO-2526)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.9-27
changelog:
  - Fix clwpos_monitoring service does not re-create redis service automatically (CLPRO-2597)
  - Added CloudLinux MAx WebServer support for WordPress plugin (AP2NGX-222)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 1.8-1
changelog:
  - Migrate codebase to Python3.11 (CLPRO-1124)
  - Fix getting upgrade url for AccelerateWP Premium and AccelerateWP CDN (CLPRO-1182)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 1.8-2
changelog:
  - Add Solo/Admin editions support (CLPRO-1081)
  - Fix getting custom ini path in enable_redis_for_alt_php script (CLPRO-1235)
  - Fix issues reported by Sentry (CLPRO-1237)
  - Don't scan user websites when AWP is turned off (CLPRO-1227)


author: Timur Kalimullin <tkalimullin@cloudlinux.com> - 1.8-3
changelog:
  - Implement email cancellation in cloudlinux-awp-admin (CLPRO-1191)
  - Improving processing of json wp-cli command output when there is excess output (CLPRO-796)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-19.1
changelog:
  - ALTPHP-1501: Update to 7.1.1-19
  - Updated libwebp to 1.3.2
  - Added package with libraries for static linking
  - Build with newer libraries for RHEL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.1-43.1
changelog:
  - ALTPHP-1896: Update to 7.1.1-43
  - ALTPHP-1920: Update libwebp to 1.5.0
  - ALTPHP-1932: Fix perfomance issues


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.2-29.2
changelog:
  - ALTEAPLN-4: Fix grid-HEIC decode deadlock/crash under constrained nproc (LVE)
    by bumping bundled libde265 to 1.1.1 and libheif to 1.23.1 and patching
    libde265 to fall back to single-threaded decoding when worker threads cannot
    be created; also cap libheif per-tile parallel decoding in the HEIC coder


author: Ali Rustamov <arustamov@cloudlinux.com> - 1.0.0-5
changelog:
  - postinst: derive apt architecture from `dpkg --print-architecture`
    instead of `uname -m`, which emitted the non-Debian token "aarch64"
    (Debian/apt use "arm64"); the generated alt-common-els.list is now
    correct on arm64


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-6
changelog:
  - Ship alt-common-els-rollout.repo with the els-alt-1..6 gradual-rollout slots
    (enabled) and their -bypass counterparts (disabled), so the ALT slot
    rollout reaches clients gradually instead of only at graduation to stable
  - postinst: write /etc/apt/sources.list.d/alt-common-els-rollout.list with the
    els-alt-1..6 gradual-rollout slots on rollout.alt.tuxcare.com (active) and
    their slot-N-bypass counterparts (commented out); the rollout host has no
    channel segment and takes no credentials, so no /etc/apt/auth.conf.d entry
    is added. postrm removes the file. (ELS-2641)
  - %post now pins $releasever in alt-common-els.repo too, not just the rollout
    file: the Amazon Linux 2 branch only covered the stable repo on AL2, so a
    plain el7 host reporting 7Server or 7.9 still asked for el/7Server/ (ELS-2334)


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.11.0-2
changelog:
  - don't add link to ldap in *.pc file if ldap.pc doesn't exist
  - don't add link to mit-krb5-gssapi in *.pc file if mit-krb5-gssapi.pc.pc doesn't exist


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.19.0-2
changelog:
  - ALTPHP-2119: patch to allow building alt-curlssl11 with OpenSSL 1.1
    (curl 8.19.0 dropped OpenSSL < 3.0 support upstream)
  - Fix OPENSSL_VERSION_STRING -> OPENSSL_VERSION for OpenSSL 1.1 compat
  - Fix doc file references: FAQ -> FAQ.md, TODO -> TODO.md, KNOWN_BUGS -> KNOWN_BUGS.md
  - Disable flaky tests 763, 1501, 1583


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 8.19.0-3
changelog:
  - ALTPHP-2106: pin alt-nghttp2 runtime requirement to the version we built
    against, to avoid undefined-symbol errors when an older alt-nghttp2 is
    installed alongside a freshly built alt-curlssl11


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.19.0-4
changelog:
  - Restore short "OpenSSL/1.1.1w" SSL version string (drop the duplicated
    "OpenSSL " prefix and trailing release date introduced when working
    around OPENSSL_VERSION_STRING for alt-openssl11)


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.21.0-2
changelog:
  - ALTPHP-2543: build libcurl with brotli support on el8+ and all deb platforms
    (--with-brotli + brotli-devel / libbrotli-dev) so curl_version() reports
    brotli and Accept-Encoding: br is handled. el7 is left without brotli (the
    libbrotlidec runtime lib is not in CL7 customer repos)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 8.21.0-3
changelog:
  - ALTEAPLN-6: honour the nscd hosts cache again. Since 8.20.0 the threaded
    resolver splits one getaddrinfo(AF_UNSPEC) call into separate AF_INET6 and
    AF_INET lookups. glibc answers a single-family AF_INET lookup via
    gethostbyname2_r(), which reaches nscd as a GETHOSTBYNAME request, and nscd
    refuses to cache those answers when they hold more than one address. Hosts
    behind a load balancer were therefore re-resolved through DNS on every
    request. Resolve both families in one AF_UNSPEC lookup when both are
    wanted, as curl did up to 8.19.x; requests pinned to a single family
    (CURLOPT_IPRESOLVE / curl --ipv4) keep their existing code path.


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.21.0-4
changelog:
  - ALTEAPLN-23: restore NTLM support. Upstream curl 8.20.0 made NTLM opt-in:
    --enable-ntlm has to be requested explicitly, whereas up to 8.19.x NTLM was
    built unless --disable-ntlm was passed. The spec passed neither flag, so
    libcurl 8.20.0 and 8.21.0 shipped without NTLM and broke NTLM-authenticated
    SOAP/HTTP calls. Pass --enable-ntlm explicitly.
    Upstream schedules NTLM for removal in September 2026 (docs/DEPRECATE.md),
    so this restores the feature for the 8.21.x series only; consumers still on
    NTLM need a migration path before the next major bump.
    SMB became opt-in in the same release and is deliberately left disabled: it
    is scheduled for removal on the same date, upstream considers it weak
    security, and it was not part of the reported regression.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.1.28-1
changelog:
  - Update to 2.1.28 to match system cyrus-sasl on EL10 (fixes
    "ldap_int_sasl_init: SASL library version mismatch: expected 2.1.28,
    got 2.1.27" when system libldap loads alt libsasl2 via php RPATH)
  - Drop cyrus-sasl-pr559-RC4-openssl.patch (merged upstream in 2.1.28)
  - Add rpath to own libdir so sbin tools find the bundled libsasl2
    without the system cyrus-sasl-lib package installed
  - Drop cyrus-sasl-2.1.23-man.patch (testsaslauthd.8 man page is shipped
    upstream in 2.1.28; applying the patch would duplicate its content)


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 1.5.3-1
changelog:
  - EA4D-914: Update to 1.5.3 (libheif 1.23.x requires the dav1d >= 1.0 API)
  - Track libdav1d.so.7 soname


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 57.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow): not applied
    for v57 yet (see TODO.md)
  - Drop SOURCE100/101 dep filters, use alt_default_filter
  - Drop downstream ".cloudlinux.1" release suffix; align Release with
    other ICU lines


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 65.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Run %check as two top-level make calls (source/test + xcheck-local)
    to dodge ICU's broken nested-make jobserver pattern; tests now run
    strictly without "||:"


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 71.1-5
changelog:
  - Merged into unified alt-libicu spec selected by --define icu_version
  - Wire ICU U_TIMEZONE_FILES_DIR to alt-libicu-tzdata via symlink at
    %{_datadir}/tzdata; alt-libicu-tzdata is now a Requires/BuildRequires
  - Apply ICU-22973 / CVE-2025-5222 (genrb buffer overflow)
  - Release bumped to align with other ICU lines


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.1.1-1
changelog:
  - Update to 1.1.1
  - Port spec to CMake (autotools build system removed upstream in 1.1.x)
  - Drop sherlock265/SDL/Qt bits and no-longer-shipped example tools


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 3.14.1-1
changelog:
  - EA4D-913: Update to 3.14.1
  - Port spec to CMake (autotools build system removed upstream in 3.10)
  - Stop shipping static libraries and libtool archives (CMake shared-only build)
  - C++ library is now versioned libgeos.so.3.14; C API soname libgeos_c.so.1
    is unchanged and stays backward compatible


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.11.1-4
changelog:
  - ALTPHP-2484: Fix CVE-2026-55200 (transport.c OOB write), CVE-2026-55199
    (EXT_INFO handler DoS), CVE-2025-15661 (sftp_symlink OOB read)


author: Andrei Zheregelia <azheregelia@cloudlinux.com> 6.0.26-3
changelog:
  - CLOS-3362: Migrate alt-mod-passenger to use cloudlinux-venv provided Python instead of alt-python37


author: Haluk Yilmaz <hyilmaz@cloudlinux.com> 6.0.26-4
changelog:
  - CLOS-3500: Add CL10 support for passenger by adding the required compilation flag for successful build


author: Andrei Zheregelia <azheregelia@cloudlinux.com> 6.0.26-5
changelog:
  - CLOS-3629: Bring an override for httpd systemd service to change PrivateHome from "read-only" to "no"


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-6
changelog:
  - CLOS-4148: Security hardening and eliminate race condition
  - CLOS-4148: Switch build dependency to alt-ruby33 (drop alt-ruby21/alt-ruby22 requirements)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-7
changelog:
  - CLOS-4285: Improved Passenger-related handling, validation, and robustness across multiple areas
  - CLOS-4148: Restore .htaccess scope for selector directives (regression fix)


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.0.26-8
changelog:
  - CLOS-4364: Allow PassengerAppLogFile in user .htaccess so cloudlinux-selector --passenger-log-file works for end users


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> 6.2.0-1
changelog:
  - CLOS-6930: Update to passenger version 6.2.0
  - CLOS-6930: Compatibility fixes for applications running on older alt-ruby interpreters
  - CLOS-6930: DirectAdmin on CloudLinux 7 stays on the alt-mod-passenger 6.0.26.x series


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.5.2-1
changelog:
  - EA4D-928: Update to 5.9.5.2 version
  - rebase net-snmp-5.7.2-pie.patch and net-snmp-5.5-dir-fix.patch onto 5.9.5.2
  - drop net-snmp-5.6-test-debug.patch and
    net-snmp-5.7.2-agentx-disconnect-crash-part2.patch, both applied upstream
  - point PKG_CONFIG_PATH at alt-openssl11: since 5.9 configure finds OpenSSL
    through pkg-config only, and without it NETSNMP_USE_OPENSSL is left undefined
  - fix the --with-openssl path typo (opnessl11 -> openssl11)
  - add libnl3 dependency: 5.9 rewrote etherlike-mib's dot3stats_linux.c on top
    of netlink, where 5.8 used ioctl and needed no such dependency
  - package the netsnmp.pc / netsnmp-agent.pc files newly installed by 5.9
  - add /opt/alt/net-snmp11/usr/lib64 to the rpath so libnetsnmpagent/libnetsnmpmibs can resolve
    their sibling libnetsnmp on CL9/CL10, where libtool no longer supplies it


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-8
changelog:
  - CVE-2023-38552: use tamper-proof integrity check function to prevent tampering
    with Hash class internals in policy mechanism


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-10
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits()
    that could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-11
changelog:
  - CVE-2022-32213: fix missing CR validation in header separators to prevent
    HTTP request smuggling via malformed headers
  - CVE-2022-32214: fix Transfer-Encoding header validation to reject invalid
    and repeated chunked encoding values
  - CVE-2022-32215: fix Transfer-Encoding header parsing to prevent smuggling
    attacks via conflicting encoding declarations
  - CVE-2022-35256: fix header overflow calculation to properly detect and
    reject oversized HTTP headers


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-13
changelog:
  - CVE-2023-46809: fix a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-14
changelog:
  - CVE-2024-22025: pause stream if outgoing buffer is full to prevent resource
    exhaustion during decompression


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-15
changelog:
  - CVE-2025-59465: add TLSSocket default error handler to prevent unhandled rejection
    on abrupt socket close


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 12.22.12-16
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism that could expose uninitialized memory when using vm module with
    timeout options, preventing potential information disclosure


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-17
changelog:
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 12.22.12-19
changelog:
  - CVE-2026-21714: propagate NGHTTP2_ERR_FLOW_CONTROL in OnInvalidFrame
    so Http2Session is destroyed after connection-level WINDOW_UPDATE overflow
    instead of leaking memory


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 12.22.12-20
changelog:
  - CVE-2026-21717: scramble V8 array-index hash_field with a 3-round
    xorshift-multiply so consecutive numeric strings no longer hash to
    consecutive buckets, preventing O(n^2) HashDoS via JSON.parse


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-21
changelog:
  - CVE-2023-30581: handle mainModule.__proto__ bypass of the experimental
    policy mechanism; set the policy-wrapped require on Module.prototype and
    use setOwnProperty for process.mainModule (backport of nodejs/node d0a8264ec9)
  - CVE-2023-44487: HTTP/2 Rapid Reset; backport the nghttp2 RST_STREAM
    rate-limit mitigation (token-bucket limiter, default burst 1000 / rate 33,
    GOAWAY on exhaustion) into bundled deps/nghttp2 (backport of nghttp2 72b4af6)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-22
changelog:
  - CVE-2026-48619: cap the HTTP/2 client originSet at 128 entries so a
    malicious server can no longer drive unbounded memory growth via repeated
    ORIGIN frames; the session is destroyed with ERR_HTTP2_TOO_MANY_ORIGINS
    once the cap is exceeded (backport of nodejs/node c79968e108)
  - CVE-2026-48930: reject dns.lookup()/dnsPromises.lookup()/net.connect()
    hostnames that contain an embedded NUL byte, preventing silent authority
    rebinding caused by C-string truncation in the resolver bindings; adds
    validateStringWithoutNullBytes (backport of nodejs/node 7dafafa2)
  - CVE-2026-48933: guard the legacy CipherBase::Update() output-length
    computation against signed-int overflow (len + block_size > INT_MAX),
    turning ~2 GiB one-shot cipher inputs into a clean failure instead of an
    out-of-bounds write; the legacy analog of the WebCrypto fix in
    nodejs/node 98fbc89211 (Node 12 has no WebCrypto)


author: Viktor Borzov <vborzov@cloudlinux.com> - 12.22.12-23
changelog:
  - CVE-2026-48931: destroy keep-alive sockets that receive unsolicited data
    while idle in the http.Agent freeSockets pool, so injected bytes can no
    longer be parsed as the response to the next request that reuses the
    socket (response-queue poisoning); backport of nodejs/node 179ddaedfb
  - CVE-2026-48937: detect a GOAWAY that nghttp2 emitted on its own initiative
    (e.g. on an oversized frame) and surface it to JS as a session error, so
    the Http2Session, its streams and its socket are released instead of
    leaking indefinitely; backport of nodejs/node 4a32c00fb8, adapted -- v12
    has no graceful-close state machine, so that guard is dropped


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 12.22.12-24
changelog:
  - CVE-2026-48618: normalize the peer hostname with domainToASCII() before
    splitting it into DNS labels in tls.checkServerIdentity(), so the verifier
    counts the same labels the resolver connected to; Unicode dot separators
    (U+3002, U+FF0E, U+FF61) can no longer defeat the wildcard-depth rule and
    make a *.example.com certificate authenticate a host two levels below it
    (backport of nodejs/node 1efb4ff51a plus the required IPv6 IP-SAN
    follow-up 1d87a24050)
  - CVE-2026-48928: add the 'i' flag to the SNI RegExp built by
    tls.Server.prototype.addContext(), so an uppercase or mixed-case SNI
    hostname selects its per-hostname SecureContext instead of silently
    falling back to the server's default context and bypassing per-tenant
    client-certificate authorization in multi-context mTLS deployments
    (backport of nodejs/node 39d1d09684)
  - CVE-2026-48934: bind a reusable TLS client session to the host it was
    authenticated for, so a session obtained from host A can no longer be
    replayed against host B to skip checkServerIdentity() via
    isSessionReused(); adds wrapSessionState/getSessionForReuse and an
    explicit TLSSocket.prototype.getSession (backport of nodejs/node
    fd890ba01d, with the fix's optional chaining rewritten to && form
    because V8 7.8 has no ?.)
  - CVE-2026-58040: bind identity checks to session and socket reuse in the
    https.Agent, the vector CVE-2026-48934 left open. A request supplying its
    own checkServerIdentity is tagged with a unique per-request index that
    Agent.prototype.getName() appends, so it gets its own pool bucket;
    createConnection() neither reads nor writes the TLS session cache for it,
    and a new keepSocketAlive() override keeps its socket out of freeSockets.
    A later request using the default strict check can therefore no longer
    inherit a session or a keep-alive socket authenticated under permissive
    rules and be reported authorized against an unverified host (backport of
    nodejs/node 51123159fe)


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 12.22.12-26
changelog:
  - CVE-2025-23167: restore HTTP/1 message-framing terminator validation in both
    parsers Node 12 bundles. In the loose (non-strict) state machine of llhttp
    2.1.6 -- the one Node compiles, since LLHTTP_STRICT_MODE is never set --
    headers_almost_done, chunk_size_almost_done and the chunk_data_almost_done /
    chunk_data_almost_done_skip pair now require the LF (resp. CR then LF) after a
    CR instead of consuming any byte, and res_line_almost_done requires the LF
    after the response status line's CR. The legacy deps/http_parser 2.9.4, which
    node.gypi also links and which --http-parser=legacy (or NODE_OPTIONS) selects
    at runtime, is built with HTTP_PARSER_STRICT=0 and had the identical defect;
    its five framing assertions are made unconditional via a new FRAMING_CHECK
    macro. A header block ending in "\r\n\rX" or a chunk terminated by "\rX" is
    now rejected with HPE_STRICT instead of swallowing the byte and parsing what
    follows as a second, smuggled request


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 12.22.12-27
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs12-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs12-zlib-devel.


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-2.tuxcare.els6
changelog:
  - CVE-2024-22019: fix improper exception handling in SignTraits::DeriveBits() that
    could lead to remote denial of service when malformed input is processed


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-4
changelog:
  - CVE-2023-32559: disable process.binding() when policy is enabled,
    update deprecations and errors docs, add new tests ensuring denial behavior,
    include new policy + app test fixtures


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 14.21.3-5
changelog:
  - CVE-2023-30589: fix llhttp parser to properly validate LF after CR
    in HTTP header fields, add lenient flag checks before allowing CR without LF,
    add test file to verify the fix prevents request smuggling attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-11
changelog:
  - CVE-2023-46809: fixes a timing‑side‑channel flaw in the RSA PKCS#1 v1.5
    decryption logic, preventing a Marvin‑style padding‑oracle attack that
    could allow recovery of sensitive data.


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 14.21.3-22
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants so consecutive numeric strings no longer collide in V8's
    internal string table (HashDoS via JSON.parse)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-23
changelog:
  - CVE-2023-30581: policy: handle mainModule.__proto__ bypass by installing
    the policy-aware require() on the module prototype and assigning
    process.mainModule via setOwnProperty(), closing the
    process.mainModule.__proto__.require() experimental-policy bypass
  - CVE-2023-44487: nghttp2 (HTTP/2 Rapid Reset): backport the upstream
    nghttp2 1.57.0 RST_STREAM token-bucket rate limiter to the bundled
    nghttp2 1.42.0 (default burst=1000, rate=33/s); excessive incoming
    RST_STREAM frames now trigger a GOAWAY instead of unbounded work


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 14.21.3-24
changelog:
  - CVE-2026-48930: dns,net: reject hostnames with embedded NUL bytes to prevent
    silent authority rebinding via C-string truncation in the resolver bindings
    (backport of nodejs/node@7dafafa2 adapted to 14.21.3: validateStringWithoutNullBytes)
  - CVE-2026-48619: http2: cap the client-side originSet size (default 128) so a
    malicious server can no longer cause unbounded memory growth via ORIGIN frames
    (backport of nodejs/node@c79968e1)
  - CVE-2026-48933: crypto: guard the cipher output-length computation against
    signed-int overflow in the legacy CipherBase::Update path in src/node_crypto.cc
    (Node 14 has no WebCrypto; adapted INT_MAX guard from nodejs/node@98fbc892)


author: Viktor Borzov <vborzov@cloudlinux.com> - 14.21.3-25
changelog:
  - CVE-2023-39333: module: stop code injection through WebAssembly export names
    in lib/internal/modules/esm/create_dynamic_module.js -- the ESM facade now
    uses index-derived local bindings and a JSONStringify-quoted
    import.meta.exports key instead of interpolating the attacker-controlled
    export name into code position (adapted from nodejs/node@eaf9083c: V8 8.4
    has no ES2022 arbitrary module namespace names, so the `export { ... as NAME }`
    clause is emitted only for names matching the IdentifierName grammar)
  - CVE-2026-48931: http: destroy keep-alive sockets that receive unsolicited data
    while idle in the Agent freeSockets pool, closing the response-queue poisoning
    window left open once responseKeepAlive() detaches the parser and its 'data'
    listener (backport of nodejs/node@0a22d401 squashed with its regression
    follow-up nodejs/node@eaa29254, which guards the idle socket at the handle
    level instead of attaching a public 'data' listener plus resume())


author: Viktor Borzov <vborzov@cloudlinux.com> - 14.21.3-26
changelog:
  - CVE-2026-48937: http2: tear down the session when nghttp2 internally queues a
    GOAWAY for a low-level protocol error. nghttp2 calls
    nghttp2_session_terminate_session() itself and returns success from
    nghttp2_session_mem_recv() without any callback, so the Http2Session stayed
    live on a dead socket, holding its streams, buffers and handle -- repeatable
    by an unauthenticated peer for memory/handle exhaustion. OnFrameSent() now
    flags a GOAWAY we did not initiate and SendPendingData() raises
    NGHTTP2_ERR_PROTO to JavaScript after it is written (backport of
    nodejs/node@a8a0d128; Node 14 has no graceful_close_initiated_ flag, so that
    term of the guard is covered by the new goaway_initiated_ flag and by
    is_closing())


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 14.21.3-28
changelog:
  - CVE-2025-23167: restore terminator validation in the loose state machine of the
    bundled llhttp 2.1.6 that Node compiles by default, so headers_almost_done,
    chunk_size_almost_done, the chunk_data_almost_done / chunk_data_almost_done_skip
    pair and res_line_almost_done require the LF (resp. CR then LF) after a CR
    instead of consuming any byte; a header block ending in "\r\n\rX" or a chunk
    terminated by "\rX" is now rejected with HPE_STRICT rather than swallowing the
    byte and parsing what follows as a second, smuggled request


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 14.21.3-29
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs14-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs14-zlib-devel.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 14.21.3-30
changelog:
  - ALTNJS-278: release bump only, no content change. The 14.21.3-29 tag was
    already in use for an unrelated commit, so the ALTNJS-278 zlib change is
    released as 14.21.3-30 instead.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1.1.1p-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free on empty digestAlgorithms)
  - Build on CL8 again: drop ExcludeArch: x86_64 (ELS-2378)


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-8
changelog:
  - CVE-2023-45143: clear Cookie and Host headers on cross-origin redirects to
    prevent sensitive data leakage


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-12
changelog:
  - CVE-2026-21637: route pskCallback exceptions through error handlers to prevent
    remote attackers from crashing TLS servers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Wojciech Tatarski <wtatarski@cloudlinux.com> - 16.20.2-13
changelog:
  - CVE-2025-55131: refactor unsafe buffer creation to remove zero-fill toggle
    mechanism preventing race condition that could expose uninitialized memory


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-16
changelog:
  - Obsolete alt-nodejs16-openssl{,-devel,-libs} < 1.1.1e on el8+ to prevent
    OPENSSL_1_1_1e symbol version mismatch when stale alt OpenSSL in RPATH
    shadows system OpenSSL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-17
changelog:
  - CVE-2025-22150: undici uses predictable Math.random() for multipart/form-data
    boundary, allowing attackers to tamper with backend requests under certain
    conditions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-18
changelog:
  - CVE-2026-21710: use null prototype for headersDistinct/trailersDistinct to
    prevent uncaught TypeError when a __proto__ header is received and the
    application accesses req.headersDistinct or req.trailersDistinct


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 16.20.2-19
changelog:
  - CVE-2026-21713: use CRYPTO_memcmp instead of memcmp in Web Cryptography
    HMAC signature verification to prevent timing attacks


author: Ivan Kuliashov <ikuliashov@cloudlinux.com> - 16.20.2-21
changelog:
  - CVE-2026-21717: v8: scramble the 24-bit array-index value stored in a
    Name's hash_field via a 3-round xorshift-multiply with compile-time
    constants, so consecutive numeric strings no longer collide in V8's
    internal string table


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-22
changelog:
  - CVE-2023-44487: HTTP/2 Rapid Reset. Backport the nghttp2 RST_STREAM
    rate-limit mitigation (token bucket, burst=1000 rate=33/s) to the bundled
    deps/nghttp2 1.47.0; once the per-connection budget is exhausted a GOAWAY
    is sent, tearing down peers that rapidly open and cancel HTTP/2 streams.
    Minimal cherry-pick of upstream nghttp2 commit 72b4af6143 (shipped in
    1.57.0), no wholesale version bump


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 16.20.2-23
changelog:
  - CVE-2026-48619: http2 client OOM via unbounded ORIGIN frames. Backport
    upstream c79968e108 (first in v22.23.0): cap the client-side originSet
    (default 128, configurable via options.maxOriginSetSize on connect) and
    destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS once exceeded.
    Node 16 is EOL, no upstream 16.x fix; vulnerable onOrigin() loop present.
  - CVE-2026-48930: TLS/DNS embedded-NUL hostname authority rebinding.
    Backport upstream 7dafafa242 (first in v22.23.0): add
    validateStringWithoutNullBytes() and reject embedded NUL bytes in the
    hostname/options.host arguments of dns.lookup, dnsPromises.lookup and
    net.connect before they reach the NUL-terminated C resolver.
  - CVE-2026-48933: WebCrypto AES cipher output-length integer overflow.
    Backport upstream 98fbc89211 (first in v22.23.0): add
    TryGetIntCipherOutputLength() guard in crypto_cipher.h and use it in
    AES_Cipher() so an input length near 2 GiB fails cleanly instead of
    overflowing the signed int buffer length and aborting the process.


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 16.20.2-24
changelog:
  - CVE-2025-23167: restore terminator validation in the loose state machine of the
    bundled llhttp that Node compiles by default (the tarball's 6.0.11 is rebased to
    6.1.1 by CVE-2024-22019 and CVE-2024-27982 earlier in this series), so
    headers_almost_done, chunk_size_almost_done, chunk_data_almost_done and
    res_line_almost_done require the LF after a CR instead of consuming any byte; a
    header block ending in "\r\n\rX" or a chunk terminated by "\rX" is now rejected
    with HPE_STRICT rather than swallowing the byte and parsing what follows as a
    second, smuggled request


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 16.20.2-25
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs16-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs16-zlib-devel.


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-11
changelog:
  - CVE-2026-21712: return original href when ada::parse fails in
    url.format() instead of crashing on malformed IDN hostnames


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-14
changelog:
  - CVE-2026-48619: cap http2 client originSet size (default 128, option
    maxOriginSetSize) and destroy the session with ERR_HTTP2_TOO_MANY_ORIGINS,
    preventing unbounded memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames containing embedded NUL bytes via
    new validateStringWithoutNullBytes, preventing silent authority rebinding
    from c-string truncation in the resolver bindings
  - CVE-2026-48933: guard the WebCrypto AES cipher output length with
    TryGetIntCipherOutputLength so ~2 GiB inputs fail cleanly instead of
    overflowing the signed int buffer length and aborting the process


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-15
changelog:
  - CVE-2026-48618: IDNA-normalize the hostname with domainToASCII() before
    label-splitting in tls.checkServerIdentity(), so Unicode dot separators
    (U+3002/U+FF0E/U+FF61) can no longer collapse labels and let a shallower
    wildcard certificate match; IP literals stay un-normalized so IPv6
    IP-Address SANs keep matching (includes follow-up 1d87a24050)
  - CVE-2026-48928: add the 'i' flag to the SNI matching RegExp built by
    tls.Server.prototype.addContext(), so uppercase or mixed-case SNI hostnames
    select their intended per-hostname SecureContext instead of falling back to
    the default context and bypassing mTLS client-certificate authorization
  - CVE-2026-48934: bind reusable client TLS sessions to the authenticated host
    by wrapping session state with the target servername and gating
    setSession()/tls.connect({ session }) through getSessionForReuse(),
    preventing a session from one host being resumed against another with
    checkServerIdentity() skipped


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-16
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool with a handle-level onread guard (installFreeSocketDataGuard /
    removeFreeSocketDataGuard), destroying sockets that receive unsolicited data
    while the HTTPParser is detached so a server can no longer poison the
    response queue of the next request; includes the upstream follow-up that
    avoids stream listeners on idle sockets
  - CVE-2026-48937: detect in OnFrameSent a GOAWAY that nghttp2 queued
    internally (no callback is invoked for frame-size, padding or HPACK
    errors) and raise NGHTTP2_ERR_PROTO at the end of SendPendingData so the
    Http2Session is destroyed after the GOAWAY is written, instead of the
    server accepting data forever on an abandoned session


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 18.20.8-17
changelog:
  - CVE-2025-23167: restore terminator validation in the loose state machine of the
    bundled llhttp 6.1.1 that Node compiles by default, so headers_almost_done,
    chunk_size_almost_done, chunk_data_almost_done and res_line_almost_done require
    the LF after a CR instead of consuming any byte; a header block ending in
    "\r\n\rX" or a chunk terminated by "\rX" is now rejected with HPE_STRICT rather
    than swallowing the byte and parsing what follows as a second, smuggled request


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 18.20.8-18
changelog:
  - CVE-2026-58040: bind HTTPS identity checks to connection and session reuse.
    Follow-up to the incomplete fix for CVE-2026-48934: https.request() now tags
    requests that pass their own checkServerIdentity (one that is neither the
    stock tls.checkServerIdentity nor inherited from the agent options) with a
    unique per-request id, https.Agent.getName() mixes that id into the agent
    key, createConnection() skips the TLS session cache for such requests and a
    new https.Agent.keepSocketAlive() override refuses to park their sockets in
    freeSockets, so a per-request callback can no longer be skipped by reusing a
    socket or a TLS session whose identity was accepted by a different callback


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 18.20.8-20
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs18-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs18-zlib-devel.


author: Krystyna Tomaszewa <ktomaszewa@cloudlinux.com> - 18.20.8-5
changelog:
  - CVE-2026-21637: wrap pskCallback and ALPNCallback invocations in try-catch
    blocks to route exceptions through error handlers
  - CVE-2025-59466: rethrow stack overflow exceptions in async_hooks instead of
    calling FatalException


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 19.9.0-7
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs19-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs19-zlib-devel.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 20.20.2-3
changelog:
  - CVE-2026-48619: cap HTTP/2 client originSet size to prevent unbounded
    memory growth from malicious ORIGIN frames
  - CVE-2026-48930: reject dns/net hostnames with embedded NUL bytes to
    prevent silent authority rebinding via C-string truncation
  - CVE-2026-48933: guard WebCrypto cipher output length to avoid signed
    integer overflow on ~2 GiB inputs


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-4
changelog:
  - CVE-2026-48618: tls: normalize the hostname with domainToASCII() before
    splitting it into labels in checkServerIdentity(), so Unicode dot
    separators cannot defeat the wildcard-depth check
  - CVE-2026-48928: tls: match SNI contexts case-insensitively in
    Server.prototype.addContext() as required by RFC 6066
  - CVE-2026-48934: tls: bind reusable client sessions to the host they were
    authenticated for, so a resumed session cannot skip host verification


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-5
changelog:
  - CVE-2026-48931: guard idle keep-alive sockets in the http.Agent freeSockets
    pool against unsolicited data to prevent response queue poisoning
  - CVE-2026-48937: destroy the HTTP/2 session when nghttp2 internally sends a
    GOAWAY so the server stops accepting data after a protocol error


author: Tamar Zerekidze <tzerekidze@cloudlinux.com> - 20.20.2-6
changelog:
  - CVE-2026-48617: gate process.report.writeReport() on the fs.write permission
    so diagnostic reports cannot escape the --allow-fs-write allow-list
  - CVE-2026-48935: disable FileHandle.utimes() when the Permission Model is
    enabled so file timestamps cannot be changed with read-only access


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 20.20.2-8
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs20-zlib collection.
    On CL7 node is now built against its bundled deps/zlib, because the base OS
    zlib 1.2.7 makes npm fail with Z_DATA_ERROR while inflating registry
    responses. Other platforms keep linking the system zlib as before.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs20-zlib-devel.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 22.23.2-3
changelog:
  - ALTNJS-278: stop depending on the SCL-scoped alt-nodejs22-zlib collection.
    On el7 node is built against its bundled deps/zlib instead of --shared-zlib,
    matching the branches that publish for el7, where the base OS zlib 1.2.7
    makes npm fail with Z_DATA_ERROR while inflating registry responses.
  - ALTNJS-278: BuildRequire the SCL runtime explicitly on el7; it used to arrive
    transitively through alt-nodejs22-zlib-devel.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.9.10-1
changelog:
  - Update to 6.9.10
  - Drop betaver macro: 6.9.10 has no revised re-release (rev1 was 6.9.5-only)
  - Build with --enable-binary-compatible-posix-api: keep exporting the
    unprefixed POSIX symbols (regcomp/regexec/regfree/regerror + reg_*)
    that 6.9.5 exported; upstream renamed them to onig_posix_* in 6.9.6
    and the soname does not change, so dropping them would be a silent
    ABI break for any POSIX-API consumer


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.4.59-1
changelog:
  - EA4D-969: Update to 2.4.59
  - Drop openldap-ldapi-sasl.patch and the two ITS7595 OpenSSL EC support
    patches, all taken upstream in 2.4.59
  - Drop openldap-tlso-use-openssl-api-to-verify-host.patch, superseded by the
    TLS_REQSAN option upstream added in 2.4.52 (ITS#9318)
  - Set the TLS_REQSAN default to try, preserving the #1740070 behaviour via
    upstream's own SAN check (matches RHEL 8 openldap-2.4.46-18)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.0.2u-4
changelog:
  - Fix CVE-2026-45447 (PKCS7_verify use-after-free)
  - Guard -Wno-error=incompatible-pointer-types/-implicit-function-declaration
    to gcc >= 6 (rhel >= 8) so the build no longer fails on CL7 gcc 4.8.5


author: Areg Gasparyan <agasparyan@cloudlinux.com> - 1:1.1.1w-3
changelog:
  - CVE-2025-68160: fix heap buffer overflow in BIO_f_linebuffer when next BIO
    performs short writes
  - CVE-2025-69418: fix OCB AES-NI/HW stream path leaving trailing bytes
    unauthenticated/unencrypted by advancing pointers after stream processing
  - CVE-2025-69419: fix out-of-bounds write in OPENSSL_uni2utf8 and do_buf
    by checking return code of UTF8_putc/bmp_to_utf8
  - CVE-2025-69420: fix missing ASN1_TYPE validation in TS_RESP_verify_response
    for signing certificate attributes
  - CVE-2025-69421: fix NULL pointer dereference in PKCS12_item_decrypt_d2i
    by adding NULL check for oct parameter
  - CVE-2026-22795: fix ASN1_TYPE validation in PKCS12 parsing (p12_kiss.c)
    and s_client.c before accessing union members
  - CVE-2026-22796: fix ASN1_TYPE type confusion in PKCS7_digest_from_attributes
    by validating type before accessing as OCTET_STRING


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.2
changelog:
  - CVE-2023-5678: fix excessive time in DH check/generation with large Q
    parameter by adding bounds checks in DH_check_pub_key and DH_generate_key
  - CVE-2024-0727: fix PKCS12 decoding NULL pointer dereference by adding NULL
    checks where ContentInfo data can be NULL


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.3
changelog:
  - CVE-2026-28387: fix use-after-free in DANE client code by using X509_free()
    instead of OPENSSL_free() to properly release reference-counted X509 objects
  - CVE-2026-28388: fix NULL pointer dereference when processing a delta CRL
    that has a Delta CRL Indicator but lacks a CRL Number extension
  - CVE-2026-28389: fix NULL pointer dereference in CMS KeyAgreeRecipientInfo
    processing when KeyEncryptionAlgorithmIdentifier omits the optional
    parameter field, by using safe X509_ALGOR_get0() extraction
  - CVE-2026-28390: fix NULL pointer dereference in CMS KeyTransportRecipientInfo
    processing when RSA-OAEP SourceFunc parameters are missing, by using safe
    X509_ALGOR_get0() extraction and OPENSSL_memdup() for label data


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 1:1.1.1w-3.4
changelog:
  - CVE-2026-45447: fix use-after-free in PKCS7_verify triggered by a crafted
    PKCS#7 / S-MIME message with an empty digestAlgorithms ASN.1 SET, which made
    OpenSSL free a caller-owned BIO; free the BIO chain explicitly and stop at
    the caller-supplied indata BIO


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 1:1.1.1w-3.5
changelog:
  - HollowByte: grow the handshake init_buf incrementally as data is received
    instead of pre-allocating the full peer-declared message size, so a peer
    that claims a large message but never sends it can no longer strand memory
    (ELS-2635). Backport of OpenSSL 3.0 commit c5785a5e35 (PR #30794); handled
    by OpenSSL as a "bug or hardening" fix with no CVE assigned


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 1-3
changelog:
  - ALTPHP-2477: Read session settings via stdin-piped PHP instead of `php -r`, which php-cgi rejects on cPanel


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-45
changelog:
  - fix version compare in multiphp_reconfigure script
  - exec /multiphp_reconfigure after installation for cPanel > 100.0


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-46
changelog:
  - rewrite code for versions comparing in multiphp_reconfigure.py script
  - rewrite alt-php-mysql-reconfigure.py for ubuntu support


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-50
changelog:
  - ALTPHP-1376: fix detecting libmysqlclient.so version
  - ALTPHP-1396: restore alt-php.cfg if it's broken


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-54
changelog:
  - ALTPHP-1582: add support cl-MariaDB1011
  - ALTPHP-1626: return mysqli.so for alt-php >= 82
  - ALTPHP-1637: rebuild with system python from BaseOS repo


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-63
changelog:
  - do not create symlinks to mysqli on plesk
  - hardcode x86_64-linux-gnu to lib path in alt-php-mysql-reconfigure
    script


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-64
changelog:
  - for plesk panel create symlinks:
      mysqli.so -> nd_mysqli.so
      pdo_mysql.so -> nd_pdo_mysql.so
  - for plesk panel do not create any symlinks for ini configs


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-65
changelog:
  - ALTPHP-2180: Fixed processing mysql.so (for PHP 5x) in Plesk environment
  - ALTPHP-2180: Call alt-php-mysql-reconfigure in Plesk environment wthout installed bindings


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1-70
changelog:
  - ALTPHP-2242: Add --driver native|binding switch to reconfigure: toggles the
    active mysql driver (native nd_mysqli/nd_pdo_mysql vs client-lib bindings)
    per alt-php version. Bindings stay managed for all versions.
  - ALTPHP-2242: Fix MariaDB 11.x binding-name mapping (11.8 -> mariadb118, not
    mariadb1108) so switching to --driver binding works on Debian 13 / MariaDB
    11.x systems.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1-71
changelog:
  - ALTPHP-2242: Fix MariaDB 11.x binding-name mapping — the 11.x names are
    inconsistent upstream (11.4 -> mariadb1104 zero-padded, 11.8 -> mariadb118
    unpadded), so use an explicit map instead of a single transform.
  - ALTPHP-2242: Honour the reconfiguration freeze (/opt/alt/alt-php-config/disable)
    for --driver too (check moved before the driver switch).
  - ALTPHP-2242: --driver binding writes a version-aware mysqli.ini (php<82 loads
    plain mysqli.so without mysqlnd.so).
  - ALTPHP-2242: --driver (native and binding) returns non-zero when the switch
    is not fully applied (missing nd_*, ini write/activation, or symlink refresh
    errors); the freeze check now runs after option validation.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1-72
changelog:
  - ALTEAPLN-12: Drop extension=mysqlnd.so from the native pdo_mysql.ini body in
    reconfigure's DRIVER_INI. mysqli.ini declares it and php.d is scanned
    alphabetically, so the duplicate only made PHP print 'Module "mysqlnd" is
    already loaded in Unknown on line 0'. The native bodies now match the binding
    ones, where mysqlnd.so has always been declared in mysqli.ini only.
  - ALTEAPLN-12: Add unit tests pinning the native ini bodies and asserting that
    mysqlnd.so is declared in exactly one file (mysqli.ini) for every driver.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1-73
changelog:
  - ALTEAPLN-12: Give mysqlnd a single owner instead of relying on mysqli.ini.
    1-72 dropped extension=mysqlnd.so from the native pdo_mysql.ini body, which
    silenced the duplicate-load warning but left nd_pdo_mysql.so with no mysqlnd
    whenever mysqli was disabled - pdo_mysql then failed to load at all (verified
    on CL9; binding mode kept working in that config). reconfigure now writes
    php.d/00-mysqlnd.ini as the sole owner on php82+, and no DRIVER_INI alias body
    declares mysqlnd.so in either driver mode. The 00- prefix is required: php.d is
    scanned alphabetically and mysqli.ini sorts before mysqlnd.ini, so nd_mysqli.so
    would otherwise fail with 'undefined symbol: mysqlnd_global_stats'.
  - ALTEAPLN-12: The php82+ binding mysqli.so is also mysqlnd-based, so the binding
    body no longer declares mysqlnd.so either; the owner file covers both modes.
    This drops the version-aware binding special case for php<82.


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.4.33-4
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-7
changelog:
  - Fix for hardened PHP
  - CVE-2023-0567: Fix validation of malformed BCrypt hashes
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-10
changelog:
  - ALTPHP-1531: add provides alt-php-handler-lsphp and alt-php81-handler-lsphp
  - remove changes from ALTPHP-1508


author: Nikita Ivanov <nivanov@cloudlinux.com> - 7.4.33-12
changelog:
  - Fix for hardened PHP
  - CVE-2023-3823: Fix external entity loading in XML without enabling by
    sanitizing libxml2 globals before parsing
  - CVE-2023-3824: Fix buffer mismanagement in phar_dir_read()


author: Daniil Danilkin <ddanilkin@cloudlinux.com> - 0.4-4
changelog:
  - Adds explicit error if user's CL isn't registered (CLPRO-1487)
  - Enable/disable SSO twice isn't a error anymore for CLI (CLPRO-1553)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.4-5
changelog:
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Increase string length parameter during Sentry init (CLPRO-1578)


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Sergey Kokhan <skokhan@cloudlinux.com> - 0.4-7
changelog:
  - Improve report email templates (CLPRO-1055)
  - Extend logging with detection of WP2 environment (CLPRO-1899)
  - Simplified the code of building SSA extensions (CLPRO-1946)
  - Added alt-php82 support for CL6 (CLPRO-1947)
  - Added ea-php83 support (CLPRO-1948)


author: Denis Komandyr <dkomandyr@cloudlinux.com> - 0.4-8
changelog:
  - Fixed SSA service when ssa.conf is empty (CLPRO-566)
  - Added special characters escaping in database query (CLPRO-2043)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-10
changelog:
  - Fixed an error on DirectAdmin that lead to the 'xray.so' extension was not placed to extensions dir (CLPRO-1409)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-16
changelog:
  - CLPRO-1623: Fix Database error for PHP Slow Site Analyzer
  - CLPRO-2695: Add linefeed in clos_ssa.ini


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-18
changelog:
  - CLPRO-2911: Prevent the creation of clos_php.ini files for PHP versions that are not yet supported by alt-php-ssa.


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.4-19
changelog:
  - Added PHP 8.5 support for Slow Site Analyzer (CLPRO-2910)
  - Fix conflicts between X-Ray and Slow Site Analyzer modules on PHP85 (CLPRO-2929)


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-26
changelog:
  - CLPRO-3068: Improved SSA agent input handling, manager operation logging, and configuration validation


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-27
changelog:
  - CLPRO-3077: Bound SSA agent memory during daily maintenance on large databases
  - CLPRO-3076: Improved disable-ssa to fully stop and disable the agent's systemd units
  - CLPRO-3118: Raise ssa-agent TasksMax, pin numpy BLAS threads to one, and keep the accept loop alive when thread creation fails
  - CLPRO-3175: Fixed ssa-agent.service failing to start on servers without CageFS installed


author: Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Dasha Kavchuk <dkavchuk@cloudlinux.com> - 0.3-8
changelog:
  - CLPRO-228: Add support of CL9
  - XRAY-711: Fix copying clos_ssa extensions for DirectAdmin
  - XRAY-721: Enable autotracing, but block it from working in case of malfunctions present


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-30
changelog:
  - CLPRO-3235: Grant ssa-agent write access to InterWorx's log tree on InterWorx servers
  - CLPRO-3165: Adjusted SSA agent request-intake pacing and streamlined daily reporting and configuration parsing
  - CLPRO-3249: Refined SSA agent logging and diagnostic log file handling
  - CLPRO-3148: Improved per-user autotracing config reads and stale-ini cleanup


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.4-31
changelog:
  - CLPRO-3235: Fixed SSA agent crash on InterWorx servers
  - CLPRO-3310: Improved SSA agent request-intake pacing, metric-collection accuracy, telemetry queue handling, autotracer resource usage, and configuration file handling


author: Ruslan Koliada <rkoliada@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 0.4-32
changelog:
  - CLOS-6848: Fixed constant high CPU usage and telemetry loss of the SSA agent on cPanel servers with many accounts; reduced agent log noise under load
  - CLOS-6869: Fixed SSA agent shutdown when SIGTERM arrives during startup


author:
  Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 0.6-9

changelog:
  - Adding environment variable to the Sentry events (CLPRO-1317)
  - Extend advice data fields with variants in cl-smart-advice utilities (CLPRO-1155)
  - Adapt Smart Advice plugin to support DireactAdmin (CLPRO-1405)
  - Add tracking of purchase related events (CLPRO-1159)
  - Track failure to report to analytics API from JS to Sentry (CLPRO-1354)


author: Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-10
changelog:
  - Improve logging for notification status checks and advice filtering (CLPRO-1449)
  - Displaying text variant for advice in the plugin (CLPRO-1471)
  - Avoid downtime when autocomplete tasks cron executed (CLPRO-1408)
  - Add details to SmartAdvice plugin installation errors (CLPRO-1479, CLPRO-1506)


author:
  Martin Krcho <mkrcho@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 0.6-11

changelog:
  - Add optional toggle making X-Ray to automatically enable extension for all php versions (CLPRO-587)
  - Add auto-fixing for incorrect open_basedir setting values for Plesk (CLPRO-1480)
  - Cover Wordpress Admin notices (SmartAdvice) with telemetry (CLPRO-1510)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-12
changelog:
  - Added response status code to the analytics call (CLPRO-1473)
  - Update incompatibilities list for existing advices (CLPRO-1544)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-13

changelog:
  - Fix advice sync with Wordpress plugin (CLPRO-1549, CLPRO-1572)
  - Add new two events (advice_synced, advice_sync_failed) to the analytics (CLPRO-1545)
  - Rewrite run.sh script logic to the Python (CLPRO-1554)
  - Reminder emails will never be sent with cached smart advice data (CLPRO-1546)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com> - 0.6-15
changelog:
  - Added support for MyImunify Account protection advice (CLPRO-1489, CLPRO-1641)
  - Fixed E_NOTICE error in SmartAdvice plugin (CLPRO-1605)
  - Fixed error checking advice for the site in the SmartAdvice plugin (CLPRO-1606)
  - Fix checking advice_id variable (CLPRO-1622)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Dmitriy Leonov <dmleonov@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com> - 0.6-16

changelog:
  - Add ability to sync multiple users with microservice (CLPRO-1608)
  - Improve WP SmartAdvice installing and advice sync processes (CLPRO-1638)
  - Avoid problem with creating symlink to plugin file during installation of Smart Advice WP plugin (CLPRO-1637)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-17
changelog:
  - Add alternative way of retriving php version through phpinfo (CLPRO-1574)
  - Replace edition specific check with universal cpapi feature supported (CLPRO-1531)
  - Use package version for WordPress plugins (CLPRO-1602)
  - Limit number of simultaneously running threads in XRay agent (CLPRO-1634)


author:
  Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Martin Krcho <mkrcho@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-18

changelog:
  - Improve quality and usefulness of sentry reports (CLPRO-1516, CLPRO-1669)
  - Improve Sentry logging of analytics sending failures (CLPRO-1516)
  - Increase string length parameter during Sentry init (CLPRO-1578)
  - Fix disk quota exceeded on installing Smart Advice Plugin (CLPRO-1665)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-19

changelog:
  - Update website incompatibilities when AWP daemon is not running (CLPRO-1689)
  - Unify enabling End-User X-ray plugin across all editions (CLPRO-1657)
  - Extend analytics report for tracking upgrade url usage (CLPRO-1738, CLPRO-1769)


author: Dmitriy Leonov <dmleonov@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-20
changelog:
  - Give WordPress plugin info and upload the zip archive to the site temp folder (CLPRO-1492)
  - Improve the analysis of errors in applying advice (CLPRO-713, CLPRO-1786)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-21
changelog:
  - Improve error handling in the SmartAdvice plugin (CLPRO-1816)
  - Bypass open_basedir restriction in WP SmartAdvice (CLPRO-1777)
  - Fix xray-continuous cron sends emails on errors (CLPRO-1871)


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com - 0.6-22
changelog:
  - Install Smart Advice WordPress plugin only if allowed by administrator (CLPRO-1924)
  - Added wordpress-plugin-uninstall which removes all installed Smart Advice plugins (CLPRO-1926)


author: alutsiuk <alutsiuk@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> - 0.6-24
changelog:
  - Add support of translations in XRAY (CLPRO-1858)
  - Fixed php version detection in cPanel when selector is enabled (CLPRO-1457)


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-25
changelog:
  - Adding Imunify advice to the SmartAdvice plugin (CLPRO-2106, CLPRO-2107, CLPRO-2130, CLPRO-2108, CLPRO-1962, CLPRO-2157, CLPRO-2142)
  - Filter out advices for non-exist WordPress sites (CLPRO-2129)


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, Roman Krompets <rkrompets@cloudlinux.com> - 0.6-27
changelog:
  - Fixed an error on DirectAdmin "Unable to load dynamic library 'clos_ssa.so'" (CLPRO-1409)
  - Fix the display of the argument for CDN in the SmartAdvice plugin (CLPRO-2196)


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Denis Komandyr <dkomandyr@cloudlinux.com>, Timur Kalimullin <tkalimullin@cloudlinux.com> - 0.6-28

changelog:
  - Fix SmartAdvice plugin installation when AccelerateWP is not active (CLPRO-2269)
  - Fix user count tracking in Sentry events (CLPRO-2238)
  - Improved SmartAdvice plugin update (CLPRO-2300)


author: Denis Komandyr <dkomandyr@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> - 0.6-29
changelog:
  - Added alt-php84 support (CLPRO-2398)
  - Fix getting advice list if there is advice for non-existing domain (CLPRO-2207)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-33
changelog:
  - Implement automatically creation of missed /usr/share/alt-php-xray-tasks/UID directories for all users (CLPRO-2491)
  - Fixed creation of wrong cron files (CLPRO-2622)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-34
changelog:
  - Removed accelerate-wp from dependencies of alt-php-xray (CLPRO-2201)
  - Fix saving tracing task url with comma (CLPRO-1796)


author: Roman Krompets <rkrompets@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-35
changelog:
  - Domain with "www" prefix not recognized because "www" part is removed from its name that result in error (CLPRO-2752)
  - Optimization of the cl-smart-advice utility (CLPRO-2740)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-36
changelog:
  - Fixed issue when X-Ray is recognizing JTL-Shop or Shopware (eCommerce platforms) as WordPress sites (CLPRO-2154)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-41
changelog:
  - Added PHP 8.5 support for X-Ray (CLPRO-2916)
  - Part 2 of fix processes killed due to the xray.so module issue (CLPRO-2844)
  - Fix conflicts between X-Ray and Slow Site Analyzer modules on PHP85 (CLPRO-2929)


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-46
changelog:
  - CLPRO-3015, CLPRO-3023: Security fixes for X-Ray
  - CLPRO-3055: Enable ea-php xray.so builds for CloudLinux 10


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-46
changelog:
  - CLPRO-3015, CLPRO-3023: Improved Smart Advice operations, helper scripts, and local service communication
  - CLPRO-3055: Enable ea-php xray.so builds for CloudLinux 10


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-47
changelog:
  - CLPRO-3049, CLPRO-3059: Improved PHP configuration handling, analytics processing, and local service communication


author: Roman Krompets <rkrompets@cloudlinux.com> - 0.6-48
changelog:
  - CLPRO-3079: Improved Smart Advice operations, trace data processing, and local service communication


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-49
changelog:
  - CLPRO-3145: Improved trace data export, tracing task and PHP profiler data processing, and Smart Advice operations
  - CLPRO-3144: Implementation improvements and internal maintenance updates
  - CLPRO-3143: Improved Smart Advice operations and runtime configuration handling


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-51
changelog:
  - CLPRO-3205: Improved telemetry data handling, trace data processing, PHP configuration handling, and local service reliability
  - CLPRO-2672: Stopped spurious PHP profiler callback errors in domain logs when the profiler helper is unavailable, and added an open_basedir recommendation for full optimization data collection
  - CLPRO-3240: Improved Smart Advice operations, telemetry and trace data handling, and local service reliability
  - CLPRO-3258: Improve X-Ray request list filtering and grouped request stats


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-52
changelog:
  - CLPRO-3219: Internal maintenance and tooling updates
  - CLPRO-3269: Improved PHP configuration handling and local service operations
  - CLOS-5775: Do not kill users' CLI PHP processes on X-Ray task start/stop


author: Ruslan Koliada <rkoliada@cloudlinux.com> - 0.6-53
changelog:
  - CLPRO-3240: Fixed CloudLinux Manager failing to open on DirectAdmin servers after the daily X-Ray task run
  - CLOS-6825: Fixed "Unable to detect php version" error on servers with IP-based virtual hosts


author: Nikita Ivanov <nivanov@cloudlinux.com> - 5.2.17-193
changelog:
  - Fix for hardened PHP
  - CVE-2023-0568: Fix array overrun when appending slash to paths
  - CVE-2023-0662: Fix DOS vulnerabality by limiting number of parsed
    multipart body parts and printing upload limit exceed error message only once


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.2.17-198
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-201
changelog:
  - Security fixes
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-203
changelog:
  - Security fixes
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-206
changelog:
  - Security fixes
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-207
changelog:
  - Security fixes
  - CVE-2018-17082: fix cross-site scripting in apache2handler sapi
  - CVE-2018-19518: disable rsh/ssh functionality in imap to prevent argument
    injection


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-208
changelog:
  - Security fixes
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-210
changelog:
  - Security fixes
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-211
changelog:
  - Security fixes
  - CVE-2019-9022: fix DNS response parsing
  - CVE-2019-9023: complete fix heap-based buffer over-read in mbstring regular
    expression functions when supplied with invalid multibyte data


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-212
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.2.17-214
changelog:
  - Security fixes
  - CVE-2025-1220: fix null byte termination in hostnames
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.2.17-215
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-221
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.2 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.2.17-223
changelog:
  - ELS-2362: build litespeed SAPI with devtoolset-7 on CL6 (lsapi uses C11 __atomic builtins requiring gcc >= 4.7)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-225
changelog:
  - CVE-2013-4113: ext/xml heap overflow in xml_parse_into_struct() via deeply
    nested XML - parser->ltags[parser->level-1] was written past the XML_MAXLEVEL
    (255) slot allocation. Backport upstream 7d163e8 (truncate results at depth
    255 and emit "Maximum depth exceeded - Results truncated" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-226
changelog:
  - CVE-2014-3515: SplObjectStorage::unserialize() type confusion in
    ext/spl/spl_observer.c — the unserialized members payload was passed to
    zend_hash_copy() without checking it is an array. Backport the
    spl_observer.c half of upstream a374dfab (reject non-IS_ARRAY members).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.2.17-228
changelog:
  - CVE-2016-5385: httpoxy - PHP populated HTTP_PROXY from the untrusted "Proxy"
    request header in CGI/FastCGI environments, letting a remote attacker
    redirect an application's outbound HTTP traffic to an arbitrary proxy
    (_SERVER/_ENV and getenv() now honor HTTP_PROXY only from the real
    local environment; sapi_getenv() never returns HTTP_PROXY)


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.2.17-39
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.
  - ALTPHP-1769: Build for RHEL 9.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3-11
changelog:
  - add mysqlnd dependency for pdo_mysql for alt-php83
  - replace and backup ini with new if it was changed
  - rebuild alt-php.ini in posttrans section for alt-php >= 83


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3-12
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1.9.5-4
changelog:
  - Merged the PEAR 1.9.5 line (php52/php53) into the unified alt-php-pear spec;
    the version and tarball set are now selected by php_version (< 54 -> 1.9.5)


author: Anatholy Scryabin <ascryabin@cloudlinux.com> 1-13
changelog:
  - update File_MARC to 1.4.1
  - update Mail_Mime to 1.10.11
  - update Net_SMTP to 1.10.0
  - update Net_Sieve to 1.4.5


author: Sergey Fokin <sfokin@cloudlinux.com> - 0.8.0-3
changelog:
  - Fix build on el10: relax -Werror=incompatible-pointer-types for c-ares 1.34 ares_callback signature change


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-121
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-123
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-125
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Added dependency to new xdebug extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-129
changelog:
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-131
changelog:
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-132
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-134
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-135
changelog:
  - ALTPHP-2013: Moved APC, ares, bcompiler, bloomy, big_int, bz2_filter, coin_acceptor to separate packages; add runtime requires


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-137
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, mongo, quickhash, radius, rsync, stem, stomp, translit, xrange, zendopcache


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.4.4-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).
  - ALTPHP-2455: Link static ImageMagick delegate libs explicitly on el10 from bundled .la dependency_libs (fixes undefined symbols jpeg_resync_to_restart / ZSTD_initCStream / SharpYuvGetConversionMatrix).


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> 3.4.4-25
changelog:
  - ALTEAPLN-4: rebuilt against alt-ImageMagick 7.1.2-29.2 (Fix grid-HEIC decode deadlock under constrained nproc)


author: Eduard Chiganov <echiganov@cloudlinux.com> 2.1.0-1
changelog:
  - ALTPHP-1654: Newer version of memcached for alt-php 74-82.
  - EA4D-454: Create alt-phpXX-pecl-memcached.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.2.8-11
changelog:
  - ALTPHP-2283: Fix test crash from missing require_once files; fix testObject for Redis 7+ listpack.
  - ALTPHP-2283: Add PHP 5.2 early-exit to avoid running tests requiring 5.3+ features.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-167
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-1713: add ext/curl/php_curl.h to devel sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 5.3.29-173
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-175
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-178
changelog:
  - Security fixes
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.3.29-179
changelog:
  - Security fixes
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.3.29-185
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.3.29-186
changelog:
  - ALTPHP-2049: Change method of creating php_handlers for plesk.
  - ALTPHP-2060: Rename alt-phpXY-fpm to alt-phpXY-php-fpm.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-189
changelog:
  - ALTPHP-2341: Update php-fpm lve patch to extract doc_root from php_admin_values
    for CageFS per-domain isolation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.3.29-190
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php53/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-193
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.3 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.3 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-201
changelog:
  - CVE-2015-4604: fileinfo/libmagic out-of-bounds read in mcopy() FILE_SEARCH/FILE_REGEX
    (clamp offset to nbytes; backport of upstream file(1) f938112c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-203
changelog:
  - CVE-2016-5385: httpoxy - do not trust client-supplied Proxy header exposed as the HTTP_PROXY environment variable


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-204
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. Adopt the same FPM layout as php70+: a global php-fpm.conf that includes php-fpm.d/*.conf plus a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port and per-domain pools in php-fpm.d still load. On Debian-like distros the pool group is set to nogroup (no nobody group). Drop the now redundant php-fpm.conf.default/.plesk.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-205
changelog:
  - CVE-2014-1943: fileinfo denial of service (infinite recursion) via a crafted
    indirect-offset magic rule; add FILE_INDIRECT offset==0 guard and bound the
    recursion depth
  - CVE-2013-7345, CVE-2014-3538: fileinfo denial of service (CPU consumption) via
    catastrophic regex backtracking on the awk-rule detector; cap the regex search
    window (CVE-2014-3538 is the complete fix for the incomplete CVE-2013-7345 fix)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-206
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-
    padding ciphers (aes-*-wrap-pad); the output buffer was sized data_len + one
    block but RFC 5649 wrap-pad output can exceed that, so reserve an extra
    EVP_CIPHER_block_size() for EVP_CIPH_WRAP_MODE ciphers


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-207
changelog:
  - ALTPHP-2471: fix alt-php53-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php53/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 5.3.29-208
changelog:
  - CLOS-5751: isolated lsphp re-execs via its handler dir (cwd) so the per-domain PHP version applies under LSWS isolation
  - CLOS-5752: fix outside-cagefs site-token shard (uid/100 -> uid%100) to match cagefs.server get_prefix and clcagefslib


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.3.29-209
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder defects in
    ext/gd/libgd/gd_gif_in.c; reset table[1][i] instead of table[1][0] when
    clearing the LZW table, stop decoding once the LZW end code is seen instead of
    falling through with a stale code, and zero-initialise the LZW_STATIC_DATA
    scratch struct in ReadImage()
  - CVE-2026-7260: phar stack exhaustion (unbounded recursion) on circular symlink
    chains in tar-based archives (GHSA-vc5h-9ppw-p5f3); replace the self-recursion
    in phar_get_link_source() with an iterative Floyd cycle-detection walk over a
    new phar_follow_one_link() helper, and restore the path separator in
    phar_get_link_location() so that helper is idempotent


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.3.29-210
changelog:
  - ALTPHP-2571: point session.save_path in the php.ini shipped on Debian/Ubuntu
    at this version's own /opt/alt/php53/var/lib/php/session; it named php55's
    directory, so sessions were written to another runtime's tree
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php53-fpm failed to start; set it to /var/run/alt-php53-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php53-fpm from alt-php53-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php53/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php53-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php53-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php53-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Shawn Iwinski <shawn.iwinski@gmail.com> 2.1.2-1
changelog:
  - Updated to upstream version 2.1.2
  - PHP minimum version 5.3.3 instead of 5.3.2
  - Added PEAR package.xml modifications
  - Added patch for tests' bootstrap.php
  - Added tests (%check)


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 3.1.3-3
changelog:
  - Remove failing eio tests (custom_basic, grp_add, open_error, seek) on CL10 due to floating-point related issues in eio environment


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-1
changelog:
  - ALTPHP-2492: Update to 3.1.4 version
  - php85-fix.patch dropped (fix absorbed upstream in 3.1.4)
  - Exclude (php53/54/55, platform) combos with no base alt-php runtime
  - Skip kernel-flaky tests on newer platforms: fork.phpt (el10); via debian/rules
    the floating eio-env set (custom_basic/grp_add/open_error/seek) + fork on
    ubuntu24 (kernel 6.8, same set already removed on el10/debian13) and fork on
    debian13; eio_write_variation.phpt on php<=53 deb (PHP 5.4+ syntax). All are
    env/test artifacts, not eio functional regressions.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.1.4-2
changelog:
  - ALTPHP-2201: Fix the root cause of the "floating eio environment" test
    failures instead of deleting the affected tests.
    PHP_EIO_RET_IF_FAILED() inspected req->result right after libeio's SEND
    macro had already called eio_submit(), so when a worker thread finished the
    syscall first the extension returned FALSE for a request that had actually
    succeeded (eio_read/eio_open/eio_seek/eio_custom all return non-zero on
    success). eio_grp_add() then got a bool, the group lost a member request and
    the run ended in SIGSEGV. Submission can only fail with a NULL req, so that
    is now the only condition checked (eio-req-result-race.patch).
  - Fix fork.phpt deleting the parent process's file from the forked child while
    the parent's write callback still stats and reads it (fork-test-unlink-race.patch).
  - Restore eio_grp_add/eio_open_error/eio_seek and fork.phpt on el10, debian13
    and ubuntu24_04 - they are no longer removed on any platform.
  - Skip eio_custom_basic.phpt on all platforms: eio_custom() runs userspace PHP
    from a libeio worker thread with no synchronisation, so it races with the main
    thread over the output buffer. Reported upstream.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-155
changelog:
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-157
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-158
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-159
changelog:
  - ALTPHP-1087: Removed non-functional amqp package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-161
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-162
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-164
changelog:
  - ALTPHP-2014: Moved out extensions: crack, doublemetaphone, functional, haru, hidef, huffman, idn, inclued


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-165
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, libevent, mongo, ncurses, quickhash, radius, rsync, stem, stomp, translit, uri_template, xrange, zendopcache


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 4.3.0-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.1.6-1
changelog:
  - ALTPHP-1935: Support for tideways_xhprof for alt-php84.
  - ALTPHP-1957: Create alt-phpXX-pecl-xhprof-extension.


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 5.4.45-162
changelog:
  - CVE-2018-20783: fix a buffer over-read in PHAR reading functions
  - CVE-2018-19935: fix null pointer dereference in imap_mail
  - CVE-2018-14883: fix int overflow leading to heap-based buffer over-read in
    exif.c


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.4.45-173
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php54/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-178
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.4 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.4 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-186
changelog:
  - CVE-2026-14355: fix openssl_encrypt() heap buffer overflow with aes-*-wrap-pad by reserving an extra cipher block for RFC 5649 padded key-wrap output


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.4.45-187
changelog:
  - ALTPHP-2471: fix alt-php54-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php54/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.4.45-189
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql via an E'...' backslash breakout
    (GHSA-7qpv-r5mr-78m4); php_pgsql_add_quotes() wrapped a
    PQescapeStringConn()-escaped value in an E'...' literal, where a backslash
    still acts as an escape character, so a value such as "zzz\' OR 1=1 --" broke
    out of the literal and injected SQL through pg_convert(), pg_insert(),
    pg_update(), pg_delete() and pg_select(); emit a plain '...' literal instead,
    which is what PQescapeStringConn() is meant to be paired with
  - CVE-2026-9672: bundled libgd GIF LZW decoder defects in
    ext/gd/libgd/gd_gif_in.c; reset table[1][i] instead of table[1][0] when
    clearing the LZW table, stop decoding once the LZW end code is seen instead of
    falling through with a stale code, and zero-initialise the LZW_STATIC_DATA
    scratch struct in ReadImage()
  - CVE-2026-7260: phar stack exhaustion (unbounded recursion) on circular symlink
    chains in tar-based archives (GHSA-vc5h-9ppw-p5f3); replace the self-recursion
    in phar_get_link_source() with an iterative Floyd cycle-detection walk over a
    new phar_follow_one_link() helper, and restore the path separator in
    phar_get_link_location() so that helper is idempotent


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.4.45-191
changelog:
  - ALTPHP-2571: point session.save_path in the php.ini shipped on Debian/Ubuntu
    at this version's own /opt/alt/php54/var/lib/php/session; it named php55's
    directory, so sessions were written to another runtime's tree
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php54/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php54-fpm failed to start; set it to /var/run/alt-php54-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php54-fpm from alt-php54-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php54/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php54-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php54-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php54-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1.10.16-4
changelog:
  - Build fixes
  - install-pear.php: accept .tar.gz source archives (fixes missing PEAR install)
  - Combined old-PHP support: php52/php53 now build PEAR 1.9.5 from this spec


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.14.2-1
changelog:
  - ALTPHP-2268: rebuild as PECL brotli extension
  - ALTPHP-2268: rename package to alt-php*-pecl-brotli


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-144
changelog:
  - Updated gnupg to 1.5.1
  - Updated uploadprogress to 1.1.4
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Updated imagick to 3.7.0


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-150
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-151
changelog:
  - ALTPHP-1778: Moved APM to separate package
  - ALTPHP-1779: Moved weakref to separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-154
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package
  - ALTPHP-1822: Moved oci8 to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-156
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.7.0-27
changelog:
  - ALTEAPLN-26: Allow CL10 (el10) build for alt-php54 and alt-php55. Extend the
    el10 -Wno-incompatible-pointer-types workaround to the 3.7.0 track, which
    hits the same const-qualifier mismatch as 3.4.4.


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-126
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Expand allowed version list for bison package


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.5.38-131
changelog:
  - Fix for hardened PHP
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 5.5.38-141
changelog:
  - Security fixes
  - CVE-2020-7071: avoid parse_url() returning a wrong host to user
  - CVE-2020-7068: fix using of freed hash key in the phar_parse_zipfile function


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-153
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php55/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.5.38-155
changelog:
  - ALTPHP-2340: Add Conflicts with zend-guard-loader < 7.0.0-9 to opcache
    subpackage to block co-install with broken old zend-guard-loader versions


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-159
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.5 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.5 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.5.38-160
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin
  - Add remaining utf8mb4_0900 collation ids 304-323 to mysqlnd charset table (MySQL 8.0.x/8.4)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-161
changelog:
  - CLOS-4506: Fix lsphp site-isolation ctor overwriting per-vhost DOCUMENT_ROOT
  - ALTPHP-2448: Gate %postun per-user PHP Selector reset on Elevate upgrade markers


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-164
changelog:
  - CVE-2016-1283: heap buffer overflow in bundled PCRE 8.38 pcre_compile2()
    via a crafted regex with multiple identically named nested groups
    (ELSLANG-50866, ELSLANG-40077, ELSLANG-40080, ELSLANG-40110, ELSLANG-40125)
    - debian/patches/php-5.5-CVE-2016-1283.patch: backport PCRE 8.39 rev 1636 /
      PHP bug #75207 - remove the "else" so the named-group recno scan is always
      performed, over-allocating rather than under-allocating. PHP 5.5 was EOL
      before the bug #75207 backport landed for 5.6/7.0/7.1.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.5.38-167
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt()/openssl_decrypt()
    with AES key-wrap-with-padding ciphers (aes-*-wrap-pad, RFC 5649) when built
    against OpenSSL 3.x (ELSLANG-59751, ELSLANG-59676, ELSLANG-59675,
    ELSLANG-59687, ELSLANG-59692)
    - debian/patches/php-5.5-CVE-2026-14355.patch: backport upstream
      cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187) - reserve one extra
      EVP_CIPHER_block_size for EVP_CIPH_WRAP_MODE ciphers at the output-buffer
      allocation. 5.5 has no php_openssl_cipher_update() helper, so the fix is
      applied to both inline call sites (openssl_encrypt + openssl_decrypt).


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-168
changelog:
  - ALTPHP-2471: fix alt-php55-php-fpm %post scriptlet failure (exit status 1) on
    install. The postinstall chmod loop walks
    /opt/cpanel/alt-php55/root/usr/var/run/php-fpm, but that dir was never created,
    so the trailing test left the scriptlet non-zero. Create and own the cPanel
    php-fpm socket dir (etc/php-fpm.d + usr/var/run/php-fpm), ship an empty _.conf,
    and add the /opt/cpanel php-fpm.d include glob to php-fpm.conf. Parity with php56+.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.5.38-172
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php55/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-29: write a pid file. php-fpm.conf is generated from the upstream
    default where pid is commented out, so the master created none and
    alt-php55-fpm failed to start; set it to /var/run/alt-php55-fpm.pid,
    matching the PIDFile line in the unit and the php56+ layout
  - ALTEAPLN-3: drop the hard Requires on alt-php55-fpm from alt-php55-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php55/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php55-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php55-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: give the FPM master its own error_log. php-fpm.conf is
    generated from the upstream default where error_log is commented out, so
    php53, php54 and php55 all fell back to the built-in /var/log/php-fpm.log
    and wrote to one shared file; set it to /var/log/alt-php55-error.log,
    matching php56+. Also ship the FPM logrotate config that ALTPHP-2168 added
    for php56+ but skipped for 5.3-5.5, so the log is now rotated
    The config sets rotate 7 so a week of error logs is kept: logrotate
    defaults to rotate 0, which deletes the previous log on every rotation
    instead of retaining any history


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-133
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved geos to separate package
  - Moved redis to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-138
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package
  - ALTPHP-1796: CL9 support


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-146
changelog:
  - ALTPHP-2016: Moved out extensions: SPL_Types, libevent, mongo, ncurses, quickhash, radius, rsync, stem, stomp, translit, uri_template, xrange


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.0.0-10
changelog:
  - ALTPHP-2340: Remove self-Obsoletes and Conflicts to fix DNF resolver conflict
    with old 7.0.0-8 still present in stable repos
  - ALTPHP-2340: Strip invalid RPATH from ZendGuardLoader.so to fix CL10 build
  - ALTPHP-2340: Exclude alt-php55-zend-guard-loader from RHEL >= 10 (no alt-php55-devel)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.0-12
changelog:
  - ALTPHP-2352: exclude php55 from debian11/12 + ubuntu22/24 (no alt-php55 core
    shipped there, so alt-php55-dev dependency is unsatisfiable); php56 unaffected


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-108.1
changelog:
  - ALTPHP-2148: Remove erroneous HAVE_UNIX_H from php_config.h
  - ALTPHP-2132: remove php_handler header from /etc/psa/php_versions.d/alt-php*.conf


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 5.6.40-117
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php56/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-122
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
    (5.6 backport applies addref half only; ref_map ZVAL_PTR_DTOR is
    intentionally omitted because ref_map is heterogeneous in 5.x and the
    dtor would corrupt the xmlNodePtr entries — see patch header)
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-7261: soap extension use-after-free with SOAP_PERSISTENCE_SESSION header parsing failure
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri and query_string
    (5.6 backport applies HTML entity escape to both HTML and JSON /status
    endpoints since php_json_encode_string() isn't exported on 5.x — JSON
    consumers will see HTML entities in request_uri/query_string fields)


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
changelog:
  * Mon Jun 09 2026 Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-129
  - Bump release to include CLOS-4506 and ALTPHP-2448 in RPM tag


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-132
changelog:
  - ALTPHP-2485: ship a default www.conf pool listening on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) so alt-phpXY-fpm starts on non-panel hosts without colliding on 127.0.0.1:9000; php-fpm.conf already includes php-fpm.d/*.conf. group=nogroup on Debian-like distros. Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-133
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers. The output buffer was sized as data_len + one cipher
    block, which under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and
    overflows the heap when built against OpenSSL 3.x. Backport of upstream commit
    cbc0489126 (GH-22187): reserve one extra block for EVP_CIPH_WRAP_MODE ciphers.
    (5.6 has no php_openssl_cipher_update() helper; the fix is applied to the inline
    allocations in both openssl_encrypt() and openssl_decrypt())


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 5.6.40-135
changelog:
  - CVE-2026-9672: three defects in the GIF LZW decoder of the bundled libgd
    (ext/gd/libgd/gd_gif_in.c), reachable from attacker-controlled GIF data:
    the prefix/suffix table reset cleared table[1][0] repeatedly instead of
    table[1][i], the LZW end_code branch fell through and kept decoding with a
    stale code when the trailing data blocks drained cleanly, and ReadImage()
    left its LZW_STATIC_DATA scratch struct uninitialised. Backport of upstream
    commit fcd691b377d0 (libgd patch by Pierre Joye), byte-identical to upstream.
  - CVE-2026-17543: SQL injection in ext/pgsql (GHSA-7qpv-r5mr-78m4).
    php_pgsql_add_quotes() wrapped a PQescapeStringConn()-escaped value in an
    E'...' literal, where a backslash is an escape character, so a value such as
    "zzz\' OR 1=1 --" escaped the doubled quote and broke out of the literal via
    pg_convert()/pg_insert()/pg_update()/pg_delete()/pg_select(). Backport of
    upstream commit ab048bd83b57: emit a plain '...' literal, which is what
    PQescapeStringConn() is documented to be used with. 5.6 builds the literal
    with smart_str, so the fix drops the smart_str_appendc(&str, 'E') call.
    The pg_convert()/pg_insert()/pg_update() expectations are updated for the
    dropped E prefix, including the 5.6-era non-"_9" duplicates upstream no
    longer ships, and a 5.6-compatible replacement for the upstream regression
    test is added.
  - CVE-2026-7260: phar stack exhaustion on a circular symlink chain in a
    tar-based archive (GHSA-vc5h-9ppw-p5f3). phar_get_link_source() recursed
    into itself with no cycle detection, so an archive whose symlinks form a
    loop crashed the process on open/read. Backport of upstream commit
    2e0fa0a44441: a new static phar_follow_one_link() performs a single hop and
    phar_get_link_source() walks the chain iteratively with Floyd cycle
    detection (kept on the 5.6 zend_hash_find()/TSRMLS API). Also restores the
    path separator in phar_get_link_location() ("*p = '/'"), without which the
    Floyd walk's second visit to an entry resolves a truncated prefix and
    crashes on *valid* nested archives; upstream carries the same defect but
    its fixtures use flat entry names and never reach that branch. Adds
    ext/phar/tests/tar/gh21986.phpt, taken from the earlier public fix
    b2de3cf170 because it needs no binary fixture; it segfaults on an
    unpatched 5.6.40 build and passes on a patched one.


author: Sergey Fokin <sfokin@cloudlinux.com> - 5.6.40-136
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php56/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php56-fpm from alt-php56-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php56/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php56-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php56-php-fpm rather than
    alt-php56-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Dmitriy Popov <dpopov@cloudlinux.com> - 5.6.40-80
changelog:
  - CVE-2023-3247: Fix missing randomness check for SOAP HTTP Digest
  - Remove generated zend_language files from tarball
  - Constraint max version for bison package


author: Eduard Chiganov <echiganov@cloudlinux.com> - 5.6.40-14
changelog:
  - ALTPHP-1719: Remove deprecated sql bindings:
  - mysql50, mysql51, mysql55, mariadb55, mariadb100, mariadb101, percona55, percona56.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-113
changelog:
  - Moved timezonedb to separate package
  - Moved imagick to separate package
  - Moved xdebug to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-116
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension
  - ALTPHP-1790: Moved msgpack to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.8.1-20
changelog:
  - ALTPHP-2455: Allow CL10 (el10) build for alt-php53; keep php52/54/55 excluded (not on CL10).
  - ALTPHP-2455: Add -Wno-incompatible-pointer-types for GCC 15 (const mismatch in imagick_file.c).


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.8.1-22
changelog:
  - ALTPHP-2352: drop redundant php8.5 smart-string patch on Debian (3.8.1 already includes the fix; patch rejected and broke the deb build)


author: Huseyn Hajizada <hhajizada@cloudlinux.com> 4.2.0-3
changelog:
  - Skip test 065phpt (Directory streams with RecursiveDirectoryIterator).
  PECL RAR dir_readdir returns full paths instead of single path components,
  so RecursiveDirectoryIterator only lists 4 files instead of 10. Proper fix
  belongs in rar_stream.c (php_rar_dir_ops_read).


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.0.33-92
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: Heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-96
changelog:
  - Security fixes
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-97
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()
  - CVE-2019-11034: fix possible infoleak or crush caused by read past allocated
    buffer in exif_process_IFD_TAG()


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-99
changelog:
  - Security fixes
  - CVE-2019-11036: fix infoleak of crash via read past allocated buffer in
    exif_process_IFD_TAG()
  - CVE-2019-11035: fix potential infoleak or crash via read past allocated buffer
    in exif_iif_add_value()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.0.33-103
changelog:
  - Security fixes
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-110
changelog:
  - ALTPHP-2132: update plesk's handler conf file
  - ALTPHP-2131: leave only one php.fpm config
  - EA4D-687: set error_log env in php.ini
  - ALTPHP-2080: Refactor debian spec


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-112.2
changelog:
  - Security fixes
  - CVE-2015-9253: fix PHP-FPM exhaustion CPU and memory issue causing denial
    of service


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-118
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php70/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-124
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.0.33-125
changelog:
  - Add caching_sha2_password authentication support to mysqlnd (backport from PHP 7.4),
    allowing connections to MySQL 8.0/8.4 servers using the default auth plugin


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-134
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default www.conf pool now listens on a per-version unix socket (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple alt-php FPM services no longer collide on the same TCP port. On Debian-like distros the pool group is set to nogroup (no nobody group). Ship an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-135
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-pad
    (aes-*-wrap-pad) ciphers; the output buffer was sized as
    data_len + EVP_CIPHER_block_size, which under-sizes RFC 5649 padded-wrap
    output. Reserve an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of
    upstream php-src cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.0.33-137
changelog:
  - CVE-2026-9672: three defects in the GIF LZW decoder of the bundled libgd -
    the code-table reset loop wrote sd->table[1][0] instead of sd->table[1][i]
    so most of table[1] kept stale data, LWZReadByte_() kept decoding past the
    end-of-information code when the trailing data blocks drained cleanly, and
    ReadImage() left its LZW_STATIC_DATA uninitialised on the stack
  - CVE-2026-17543: SQL injection in ext/pgsql - php_pgsql_add_quotes() wrapped
    values in an E'...' literal, in which the backslash left unescaped by
    PQescapeStringConn() (the default standard_conforming_strings=on doubles
    only the quote) escapes the following quote and lets a payload break out;
    pg_convert(), pg_insert(), pg_update(), pg_delete() and pg_select() are
    affected. Now quoted with a plain '...' literal
  - CVE-2026-7260: unbounded recursion in phar_get_link_source() when a
    tar-based phar archive contains a circular symlink chain; resolution is now
    an iterative walk with Floyd cycle detection, returning NULL on a cycle


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.0.33-138
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php70/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php70-fpm from alt-php70-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php70/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php70-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php70-php-fpm rather than
    alt-php70-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-69
changelog:
  - Fix for harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.0.33-71
changelog:
  - Fix for Harden PHP
  - CVE-2022-31631: Fix integer overflow that could cause PDO::quote() to return an improperly quoted string
  - Fix build dependencies


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.0.33-86
changelog:
  - Fix for hardened PHP
  - CVE-2024-5458: Fix early-out for ipv6 hostname validation, ensure full check
    is performed


author: Sergey Fokin <sfokin@cloudlinux.com> - 1.0.0-5.dfe1ab17b0
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/geos.ini
    so geos loads outside cagefs/panel.


author: Sergey Fokin <sfokin@cloudlinux.com> - 15.5.0-2
changelog:
  - ALTPHP-2352: install default 00-ioncube_loader.ini into /opt/alt/phpXX/etc/php.d.std/
    so ioncube loads outside cagefs/panel.


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-1
changelog:
  - ALTPHP-2491: Update apcu to 5.1.28
  - ALTPHP-2491: Remove obsolete php85-fix.patch entirely (report_memleaks fixed upstream; apc_entry_003.phpt rewritten upstream in 5.1.28 so its base EXPECTF already matches php85); drop %prep removal of tests/bug63224.phpt (removed upstream)
  - ALTPHP-2491: Skip tests/apc_mmap_hugepage_002.phpt (needs reserved hugepages, unavailable in build-system QA)


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 5.1.28-2
changelog:
  - ALTPHP-2491: Skip all tests/apc_mmap_hugepage_*.phpt (005/006 fatal on CL7 3.10 kernel without hugepage support, family needs reserved hugepages unavailable in build-system QA)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 0.21.0-1
changelog:
  - ALTPHP-2575: Update to 0.21.0 version
  - ALTPHP-2575: link with -Wl,-Bsymbolic-functions so the bundled brotli decoder
    is not interposed by the system libbrotlidec (fixes brotli_uncompress()
    returning false on CL8/php85)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-96
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Moved rar to separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-99
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Moved solr to separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-100
changelog:
  - ALTPHP-1786: Moved propro to separate package
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-101
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1798: Added dependency to new apcu-bc extension
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-103
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-104
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.81.0-1
changelog:
  - ALTPHP-2450: Update to 1.81.0 version
  - Build with GCC 10 on Ubuntu 20.04 (default GCC 9 ICEs on grpc 1.81.0)
  - Exclude PHP 8.4/8.5 on Ubuntu 16.04 (no alt-php84/85 for Xenial)


author: Eduard Chiganov <echiganov@cloudlinux.com> 3.2.15-1
changelog:
  - EA4D-454: Create alt-phpXX-pecl-igbinary.
  - ALTPHP-1686: Newer version of igbinary for alt-php 70-83.


author: Sergey Fokin <sfokin@cloudlinux.com> - 3.2.16-6
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/40-igbinary.ini
    so igbinary loads outside cagefs/panel. Prefix 40- loads after msgpack (20-).


author: Sergey Fokin <sfokin@cloudlinux.com> - 2.2.0-2
changelog:
  - ALTPHP-2352: install default .ini into /opt/alt/phpXX/etc/php.d.std/20-msgpack.ini
    so msgpack loads outside cagefs/panel. Load-order prefix 20- (base dep).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 5.3.7-11
changelog:
  - ALTPHP-2283: Fix testObject for Redis 7+ listpack encoding.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Merge older-OS test skips into main patch; apply unconditionally.


author: Levon Matshkalyan <levon.matshkalyan@cloudlinux.com> - 5.0.4-3
changelog:
  - ALTPHP-2268: Add Provides/Obsoletes for zts in tideways-zts subpackage to support rename and avoid file conflicts


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 0.13.0-2
changelog:
  - ALTPHP-2282: EL10+ support for PHP <= 7.4:
    - PHP 7.0 still needs pcre1 (its own php_pcre.h #includes "pcre.h");
      use alt-pcre-devel from /opt/alt/pcre/ on EL10+
    - PHP 7.1-7.3 on EL10+ compile cleanly against pcre2-devel
      (pcre1 removed from EL10 base repos)
    - QA_RPATHS=0x0002 to allow /opt/alt/pcre/ rpath under EL10's
      stricter brp-check-rpaths (matches alt-pcre.spec itself)
    - Apply altea-2282-pcre-test-compat.patch: switch the affected
      phpt EXPECT/EXPECTF patterns to %A-anchored EXPECTF so they
      pass on both pcre1 (EL7-9) and pcre2 (EL10+) builds. Covers
      cookies_encryption_warning/*, broken_configuration/encrypt_regexp_cookies_bad_regexp,
      and upload_validation/upload_validation


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-92
changelog:
  - ALTPHP-2406: use alt-libicu65 for all OS
  - ALTPHP-2406: fix unversioned alt-libicu rpath on rhel<=8


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.1.33-100
changelog:
  - CVE-2026-14355: fix openssl_encrypt() zend mm heap overflow on AES key-wrap-with-padding (aes-*-wrap-pad) by reserving an extra block for EVP_CIPH_WRAP_MODE ciphers (backport of upstream cbc0489126a7682796aad1e5fb4e51de74af162c)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.1.33-102
changelog:
  - CVE-2026-9672: fix three defects in the bundled libgd GIF LZW decoder (ext/gd/libgd/gd_gif_in.c) - reset sd->table[1][i] instead of sd->table[1][0], stop decoding after the LZW end code, and zero-initialise LZW_STATIC_DATA in ReadImage() (backport of upstream fcd691b377d02285740744bee17c0f298be227d5)
  - CVE-2026-17543: fix SQL injection in ext/pgsql - php_pgsql_add_quotes() emitted E'...' while PQescapeStringConn() only doubles the quote, letting a trailing backslash break out of the literal (backport of upstream ab048bd83b578119cf81b456526d50498421d617)
  - CVE-2026-7260: fix phar circular symlink crash - phar_get_link_source() now follows the link chain with Floyd cycle detection instead of unbounded self-recursion, and phar_get_link_location() restores the path separator it temporarily overwrites (backport of upstream 2e0fa0a44441d74bf8cc4e1ce1c8af9cd4209f52)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.1.33-103
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php71/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php71-fpm from alt-php71-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php71/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php71-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php71-php-fpm rather than
    alt-php71-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.1.33-62
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-65
changelog:
  - Security fixes
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()
  - CVE-2017-9119: handle memory limit error during string reallocation correctly


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.1.33-66
changelog:
  - Security fixes
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.1.33-70
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.1.33-84
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php71/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-83
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - Updated rar to 4.2.0
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - ALTPHP-1507: Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-84
changelog:
  - Moved uploadprogress to separate package
  - Moved newrelic to separate package
  - Added dependency to new scoutapm extension in separate package


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.0.10-1
changelog:
  - ALTPHP-2500: Update to 2.0.10 version; drop php-8.4-fix-php_rand.patch
    and php85-fix.patch (absorbed upstream)


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 2.3.0-1
changelog:
  - ALTPHP-2508: Update to 2.3.0 version; regenerate php85-fix.patch
    (header and test fixes partially absorbed upstream)


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-22
changelog:
  - Fix for Harden PHP
  - CVE-2022-31628: Fix potential infinite recursion in phar wrapper when using quine gzip file
  - CVE-2022-31629: Add cookie integrity validation


author: Pavel Mayorov <pmayorov@cloudlinux.com> - 7.2.34-23
changelog:
  - Fix for Harden PHP
  - CVE-2022-37454: Fix buffer overflow in the Keccak XKCP SHA-3 reference implementation


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.2.34-47
changelog:
  - Security fixes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - Fix #74960: heap buffer overflow via str_repeat
  - Fix #74267: segfault with streams and invalid data


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.2.34-50
changelog:
  - Security fixes
  - CVE-2019-19246: fix heap-based buffer over-read in str_lower_case_match in
    regexec.c
  - CVE-2019-9025: fix possible memcpy() execution with negative argument in
    mb_split()


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.2.34-52
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl
  - CVE-2017-9119: handle memory limit error during string reallocation correctly
  - CVE-2017-9120: Integer overflow in mysqli_real_escape_string()


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.2.34-66
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php72/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.2.34-84
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow with AES key-wrap-with-padding
    (aes-*-wrap-pad) ciphers; the output buffer was sized as data_len + one block, which
    under-sizes the RFC 5649 padded-wrap output (roundup(len,8)+8) and corrupts the zend
    heap when built against OpenSSL 3.x. Reserve an extra block for EVP_CIPH_WRAP_MODE.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.2.34-86
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder - the table reset cleared
    sd->table[1][0] instead of sd->table[1][i] so stale suffixes leaked between
    images, LWZReadByte_() kept decoding after the LZW end code when the trailing
    data block count was 0, and ReadImage() left LZW_STATIC_DATA uninitialised
  - CVE-2026-17543: SQL injection in ext/pgsql - php_pgsql_add_quotes() wrapped
    PQescapeStringConn() output in an E'...' literal, which lets a trailing
    backslash escape the closing quote while standard_conforming_strings is on.
    Emit a plain '...' literal instead
  - CVE-2026-7260: unbounded recursion in phar_get_link_source() on a circular
    symlink chain (GHSA-vc5h-9ppw-p5f3); replaced by a Floyd cycle-detection walk,
    including the phar_get_link_location() path-separator restore the walk needs


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.2.34-87
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php72/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php72-fpm from alt-php72-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php72/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php72-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php72-php-fpm rather than
    alt-php72-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-87
changelog:
  - Updated gnupg to 1.5.1
  - Updated gmagick to 2.0.6RC1
  - Updated uploadprogress to 2.0.2
  - alt-ImageMagick is linked statically now
  - Updated swoole to 4.8.13
  - Brought back old newrelic for CL6


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-90
changelog:
  - Moved swoole to separate package
  - Moved gender to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-93
changelog:
  - ALTPHP-1778: Added APM in separate package
  - ALTPHP-1779: Added weakref in separate package
  - ALTPHP-1780: Added solr in separate package
  - ALTPHP-1772: Moved LuaSandbox to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-98
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package
  - ALTPHP-1959: Moved pthreads to separate package (zts only)
  - Added missing links to zts extensions


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 1.0.7-2
changelog:
  - ALTPHP-2396: Add explicit Requires: libmcrypt so yum pulls libmcrypt
    from alt-common on CL10 instead of ea-libmcrypt (cPanel) which installs
    outside the system LD path.


author: Dmitriy Popov <dpopov@cloudlinux.com> - 7.3.33-23
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug causing
    password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.3.33-33
changelog:
  - Security fixes
  - CVE-2024-11234: fix HTTP fulluri CRLF injection
  - CVE-2024-11236: prevent integer overflow in quoters causing OOB writes
  - CVE-2024-11233: fix single byte overread with convert.quoted-printable-decode
    filter


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 7.3.33-36
changelog:
  - Security fixes
  - CVE-2017-8923: fix integer overflow when concatenating strings
  - CVE-2017-9118: fix out of bounds access in php_pcre_replace_impl


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.3.33-52
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php73/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-67
changelog:
  - ALTPHP-2485: fix alt-phpXY-fpm failing to start on non-panel hosts. The default
    www.conf pool now listens on a per-version unix socket
    (/var/run/alt-phpXY-fpm.sock) instead of the shared 127.0.0.1:9000, so multiple
    alt-php FPM services no longer collide on the same TCP port. On Debian-like
    distros the pool group is set to nogroup (no nobody group exists there). Ship
    an empty _.conf in the /opt/cpanel php-fpm.d dir so its include glob matches on
    non-cPanel hosts (suppresses the "Nothing matches" warning).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.3.33-68
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow (zend_mm heap
    corruption) with AES key-wrap-with-padding (aes-*-wrap-pad) ciphers when
    built against OpenSSL 3.x; size the output buffer for RFC 5649 padded wrap


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 7.3.33-70
changelog:
  - CLOS-5732: make the LSAPI prefork SIGCHLD handler async-signal-safe.
    Defer the in-handler lsapi_log() calls (which reach the non-recursive
    glibc tzset lock via localtime_r) to a fixed-size ring buffer drained
    at the top of the parent accept loop, fixing a self-deadlock that
    stalled worker reaping and caused zombie buildup / site outages.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.3.33-72
changelog:
  - CVE-2026-9672: bundled libgd GIF LZW decoder read an uninitialised code
    table (sd->table[1][0] instead of sd->table[1][i] in the reset loop, plus
    an uninitialised LZW_STATIC_DATA on the stack) and kept decoding past an
    end-of-stream code
  - CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted
    values escaped by PQescapeStringConn() inside an E'...' constant, so a
    trailing backslash broke out of the literal (SQL injection); emit a plain
    '...' constant instead
  - CVE-2026-7260: phar_get_link_source() followed tar symlink chains by
    unbounded recursion, so a phar with circular symlinks exhausted the C
    stack; walk the chain iteratively with Floyd cycle detection


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.3.33-73
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php73/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php73-fpm from alt-php73-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php73/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php73-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php73-php-fpm rather than
    alt-php73-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-19: backport the upstream fix for PHP bug #76601 (present since
    7.4) so two FPM reloads arriving within ~10-20 ms no longer kill the master
    with SIGUSR2 and leave the service down
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 1.0.0-6.dfe1ab17b0
changelog:
  - CLOS-5732: rebuild against alt-libgeos 3.14.1 (EA4D-913). The C++ library soname
    changed to libgeos.so.3.14, so a geos.so built against 3.6.2 fails to load with
    "libgeos-3.6.2.so: cannot open shared object file". Rebuilt, the extension links
    only the stable C API libgeos_c.so.1 and is portable across libgeos versions.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-66
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-67
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 2.2.1-3
changelog:
  - CLOS-5732: disable build-time SSL autodetection so gearman.so does not require
    gearman_client_set_ssl, fixing "undefined symbol" load failure on CloudLinux
    (libgearman is shipped without SSL). Restores the portable behaviour of 2.2.1-1.


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-3
changelog:
  - ALTPHP-1355: fix linksafe for all sub-packages
  - fix rpath for zip extension
  - add alt-php74-imunify-leveldb provides


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-18
changelog:
  - ALTPHP-953: restart lsphp when update its binary
  - ALTPHP-1573: update LiteSpeed to 8.1
  - ALTPHP-1665: pack fpm as sub-package


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 7.4.33-28
changelog:
  - Security fixes
  - CVE-2024-8925: Fix data integrity violation while parsing multipart/form-data
    boundaries larger than the read buffer
  - CVE-2024-9026: Fix possible altering of children logs
  - CVE-2024-8927: Fix bypass of cgi.force_redirect configuration


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-43
changelog:
  - ALTPHP-2168: Add include= to php-fpm.conf
  - ALTPHP-2168: Make the paths in php-fpm.conf and logrotate even


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 7.4.33-49
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php74/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 7.4.33-63
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and add Requires: alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php74-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.4.33-64
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap
    with padding (aes-*-wrap-pad). php_openssl_cipher_update() sized the output
    buffer as data_len + one cipher block, undersizing it for RFC 5649 padded
    wrap output; reserve an extra block for EVP_CIPH_WRAP_MODE ciphers.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 7.4.33-68
changelog:
  - CVE-2026-17543: pg_insert()/pg_update()/pg_select()/pg_delete() emitted
    values escaped by PQescapeStringConn() inside an E'...' constant, so a
    trailing backslash broke out of the literal (SQL injection); emit a plain
    '...' constant instead
  - CVE-2026-7260: phar_get_link_source() followed tar symlink chains by
    unbounded recursion, so a phar with circular symlinks exhausted the C
    stack; walk the chain iteratively with Floyd cycle detection


author: Nikolai Mardanov <nmardanov@cloudlinux.com> - 7.4.33-69
changelog:
  - EA4D-840: enable the FFI extension as a shared module; ffi.so ships in
    alt-php74-common with Provides/Obsoletes alt-php74-ffi for migration parity


author: Sergey Fokin <sfokin@cloudlinux.com> - 7.4.33-70
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php74-fpm from alt-php74-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php74/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php74-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php74-php-fpm rather than
    alt-php74-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-53
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Added dependency to new bitset extension
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added dependency to new htscanner extension
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added dependency to new leveldb extension


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-10
changelog:
  - ALTPHP-2283: Update to 6.3.0 version (fixes testServerInfo on Redis 8 / Valkey; upstream PR phpredis#2656).


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 6.3.0-11
changelog:
  - ALTPHP-2283: Fix test suite failures: add Redis version guards for tests requiring Redis 6.0+/6.2+.
  - ALTPHP-2283: Disable broken session tests, add platform-specific guards.
  - ALTPHP-2283: Disable testIgnoreNumbers, testExists, testServerInfo, testPackHelpers (fail on older Redis / PHP 8.5).


author: Dmitriy Popov <dpopov@cloudlinux.com> - 8.0.30-8
changelog:
  - Fix for hardened PHP
  - CVE-2024-3096: Disallow null character in bcrypt password to fix bug
    causing password_verify to erroneously return true
  - CVE-2024-2756: fix __Host-/__Secure-cookie bypass due to partial
    CVE-2022-31629 fix


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-11
changelog:
  - Actually apply php-8.0-CVE-2024-3096.patch and php-8.0-CVE-2024-2756.patch
    for Ubuntu < 22.04 and Debian < 11 systems


author: Azat Nurgaliev <anurgaliev@cloudlinux.com> - 8.0.30-23
changelog:
  - Security fixes
  - CVE-2025-1217: http stream wrapper: fix handling folded headers
  - CVE-2025-1734: http stream wrapper: fix handling headers with invalid name and no colon
  - CVE-2025-1861: fix http redirect location truncation
  - CVE-2025-1219: fix wrong `content-type` on redirect in libxml streams
  - fix regression in CVE-2024-11234 patch


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 8.0.30-25
changelog:
  - Security fixes
  - CVE-2025-6491: fix NULL pointer dereference in PHP SOAP extension via large
    XML namespace prefix
  - CVE-2025-1220: fix null byte termination in hostnames


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.0.30-37
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php80/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-42
changelog:
  - CVE-2026-6722: soap extension use-after-free via apache:Map duplicate keys
  - CVE-2025-14179: pdo_firebird SQL injection via NUL bytes in quoted strings
  - CVE-2026-7262: soap extension NULL pointer deref via apache:Map missing value
  - CVE-2026-6735: php-fpm status endpoint XSS via unescaped request_uri
  - CVE-2026-7259: mbstring NULL pointer dereference in php_mb_check_encoding()
    via mb_ereg_search_init() with Oniguruma-only encodings (iso-8859-11, UJIS,
    KOI8-R, ...)
  - CVE-2026-7261: soap SoapServer use-after-free after header parsing failure
    when SOAP_PERSISTENCE_SESSION is set
  - CVE-2026-7568: metaphone() signed integer overflow when called with >INT_MAX
    byte input on 64-bit builds


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-52
changelog:
  - ELS-2362: generate Plesk psa handler files only on rhel>=7 to match the
    %files guard (fixes "installed but unpackaged" psa files on EL6/CL6)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.0.30-54
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php80-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan-Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-55
changelog:
  - CVE-2026-14355: heap buffer overflow in openssl_encrypt() with AES key-wrap
    padding (aes-*-wrap-pad); reserve an extra EVP_CIPHER_block_size() block for
    EVP_CIPH_WRAP_MODE ciphers in php_openssl_cipher_update()


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.0.30-58
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped
    PQescapeStringConn() output in an E'...' escape-string constant, where a
    trailing backslash escapes the doubling quote and breaks out of the literal;
    emit a plain '...' literal instead
  - CVE-2026-7260: stack exhaustion in ext/phar. phar_get_link_source() followed
    symlink chains by unbounded tail recursion, so a tar-based phar with circular
    symlinks crashed the process; walk the chain iteratively with Floyd cycle
    detection and return NULL on a loop


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.0.30-59
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php80-fpm from alt-php80-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php80/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php80-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php80-php-fpm rather than
    alt-php80-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-28
changelog:
  - ALTPHP-1402: update mailparse to 3.1.4
  - ALTPHP-1408: Redis extension updated to 5.3.7
  - ALTPHP-1507: Swoole extension updated to 5.0.3
  - ALTPHP-1509: alt-ImageMagick is linked statically now
  - yaz updated to 1.2.4


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - Fixed requires
  - Brought back yaf and gnupg
  - Updated uploadprogress to 2.0.2
  - Updated gnupg to 1.5.1
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-33
changelog:
  - Moved igbinary to separate package
  - Moved memcache to separate package
  - Moved memcached to separate package
  - Moved grpc to separate package
  - Moved redis to separate package
  - Added dependency to new geos ext


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-34
changelog:
  - Moved swoole to separate package
  - Moved uuid to separate package
  - Added dependency to new rar extension in separate package
  - Added dependency to new msgpack extension in separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-36
changelog:
  - ALTPHP-1751: Moved mongodb to separate package
  - ALTPHP-1752: Moved trader to separate package
  - ALTPHP-1753: Moved eio to separate package
  - ALTPHP-1754: Moved xmlrpc to separate package
  - ALTPHP-1755: Moved sqlsrv to separate package
  - ALTPHP-1756: Moved yaz to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-38
changelog:
  - ALTPHP-1787: Moved raphf to separate package
  - ALTPHP-1788: Moved http to separate package
  - ALTPHP-1789: Moved yaml to separate package
  - ALTPHP-1781: Added dependency to new protobuf extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-39
changelog:
  - ALTPHP-1800: Moved gmagick to separate package
  - ALTPHP-1801: Moved apcu to separate package
  - ALTPHP-1802: Moved rrd to separate package
  - ALTPHP-1803: Moved oauth to separate package
  - ALTPHP-1804: Moved zmq to separate package


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-40
changelog:
  - ALTPHP-1087: Moved amqp to separate package
  - ALTPHP-1825: Moved gnupg to separate package
  - ALTPHP-1826: Moved dbase to separate package
  - ALTPHP-1827: Moved stats to separate package
  - ALTPHP-1828: Moved pdflib to separate package


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 5.9.3-2
changelog:
  - ALTPHP-2268: Fix building for PHP 8.5 (php_smart_string.h removed)
  - ALTPHP-2268: Fix building for PHP 8.5 (zend_exception_get_default() replaced with zend_ce_exception)
  - ALTPHP-2268: Fix BuildRequires for CL10 (pcre-devel removed, use pcre2-devel only)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php81/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.1.34-15
changelog:
  - ALTPHP-2406: use alt-libicu71 for all OS
  - ALTPHP-2406: drop duplicated 71 in PKG_CONFIG_PATH on rhel<=8


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.1.34-23
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php81-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.1.34-24
changelog:
  - CVE-2026-14355: openssl_encrypt() heap buffer overflow on AES key-wrap with
    padding (aes-*-wrap-pad, EVP_CIPH_WRAP_MODE). php_openssl_cipher_update() sized
    the output buffer as data_len + one cipher block, undersizing it for RFC 5649
    padded wrap output (roundup(data_len, 8) + 8) and overflowing the zend_mm heap
    under OpenSSL 3.x. Reserve one extra block for wrap-mode ciphers. Backport of
    upstream php-src commit cbc0489126a7682796aad1e5fb4e51de74af162c (GH-22187).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.1.34-27
changelog:
  - CVE-2026-17543: SQL injection in ext/pgsql. php_pgsql_add_quotes() wrapped
    values escaped by PQescapeStringConn() in an E'...' escape-string constant,
    but that escaper leaves backslashes untouched when
    standard_conforming_strings is on, so a trailing backslash escaped the
    doubling quote and broke out of the literal. Drop the E prefix so the plain
    '...' form matches what the escaper produces.
  - CVE-2026-7260: phar circular symlink crash. phar_get_link_source() followed
    symlink chains by tail recursion with no cycle or depth guard, so a tar phar
    holding circular links exhausted the C stack. Walk the chain iteratively with
    Floyd cycle detection and return NULL on a loop; also restore the '/'
    separator in phar_get_link_location() so the walk stays idempotent.


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.1.34-28
changelog:
  - ALTPHP-2571: restore the sticky-writable mode on
    /opt/alt/php81/var/lib/php/session from the Debian/Ubuntu postinst -
    dh_installdirs and dh_fixperms shipped it as 755 root:root, so no non-root
    user could write session data
  - ALTEAPLN-3: drop the hard Requires on alt-php81-fpm from alt-php81-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php81/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php81-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php81-php-fpm rather than
    alt-php81-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTPHP-2543: also add the brotli-devel build dependency here. It was applied
    to alt-php73 and alt-php82-85 but missed on this version, so on el8
    pkg-config could not resolve libcurl (alt-curlssl11 is built --with-brotli)
    and configure failed with "Package 'libbrotlidec', required by 'libcurl',
    not found".
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-19
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.16-1
changelog:
  - update to 8.2.16
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.2.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php82/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.2.31-10
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php82-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 8.2.32-5
changelog:
  - CVE-2026-7260: ext/phar - replace the self-recursion in phar_get_link_source()
    with Floyd cycle detection so circular symlinks in a tar/phar archive no longer
    exhaust the stack; phar_get_link_location() now restores the path separator it
    NUL-terminates in place
  - CVE-2026-17543: ext/pgsql - php_pgsql_add_quotes() no longer emits the E''
    escape-string form, which let a backslash break out of the literal and inject
    SQL when standard_conforming_strings is on


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.2.33-1
changelog:
  - Update to 8.2.33
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control
  - Drop the CVE-2026-7260 and CVE-2026-17543 backports: both fixes are present in
    upstream 8.2.33 (phar_get_link_source() already uses Floyd cycle detection;
    php_pgsql_add_quotes() already emits '' rather than E''), so the patches no
    longer apply and are no longer needed


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.2.33-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php82-fpm from alt-php82-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php82/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php82-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder stays owned by alt-php82-php-fpm, which is where
    every version now keeps it, and on Debian the new -php-fpm postrm deletes
    it on package removal, which dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3-24
changelog:
  - ALTPHP-2242: Default to native driver extensions (nd_mysqli/nd_pdo_mysql) on
    php82+. Client-lib bindings stay installed for all versions; switch between
    native and bindings with alt-php-mysql-reconfigure.py --driver native|binding.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3-25
changelog:
  - ALTPHP-2242: Add versioned dependency on alt-php-config (>= 1-70) for the DEB
    packages so the postinst --driver switch always finds a config new enough to
    support it (RPM already pins this via Requires(pre)).


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3-26
changelog:
  - ALTEAPLN-12: Stop declaring extension=mysqlnd.so in php.d.all/pdo_mysql.ini on
    php82+. mysqli.ini already loads it and is scanned first, so the duplicate made
    PHP print 'Module "mysqlnd" is already loaded in Unknown on line 0' on every
    invocation (and, with log_errors=On, on every request in error_log).
  - ALTEAPLN-12: Ship php.d.all/*.ini as %config(noreplace) so an upgrade keeps a
    locally edited ini and writes the packaged one as .rpmnew instead of silently
    overwriting it (matches the mysqlnd subpackage of alt-php).
  - ALTEAPLN-12: Bump the alt-php-config dependency to >= 1-72 (RPM and DEB). The
    posttrans/postinst `--driver native` rewrites these files from reconfigure's own
    DRIVER_INI, so an older alt-php-config would restore the duplicate right away.


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3-27
changelog:
  - ALTEAPLN-12: Give mysqlnd a single owner instead of dropping it from
    pdo_mysql.ini. 3-26 removed extension=mysqlnd.so from pdo_mysql.ini, which
    silenced the duplicate-load warning but left nd_pdo_mysql.so with no mysqlnd
    whenever mysqli was disabled - pdo_mysql then failed to load entirely
    (verified on CL9; binding mode and 3-24 both kept working in that config).
    mysqlnd is now declared once, in php.d/00-mysqlnd.ini, which php.d scans
    before every nd_* alias, so mysqli.ini and pdo_mysql.ini can each be enabled
    or disabled independently. The alias names cannot carry the dependency
    themselves: mysqli.ini sorts before mysqlnd.ini, so nd_mysqli.so would fail
    with 'undefined symbol: mysqlnd_global_stats'.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-20
changelog:
  - Fixed requires
  - Updated mcrypt to 1.0.6
  - Updated vips to 1.0.13
  - Updated yaml to 2.2.3
  - Updated igbinary to 3.2.14
  - alt-ImageMagick is linked statically now
  - Updated swoole to 5.0.3


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-31
changelog:
  - ALTPHP-1935: Moved xhprof to separate package
  - ALTPHP-1946: Moved bitset to separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Moved htscanner to separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Moved leveldb to separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.3-1
changelog:
  - update to 8.3.3
  - ALTPHP-1665: pack fpm as sub-package
  - ALTPHP-953: restart lsphp wheb update its binary


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.3.30-6
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php83/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.3.31-11
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php83-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.3.33-1
changelog:
  - Update to 8.3.33
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.33-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php83-fpm from alt-php83-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php83/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php83-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php83-php-fpm rather than
    alt-php83-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.3.30-1
changelog:
  - ALTPHP-2281: update to 8.3.30
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Eduard Chiganov <echiganov@cloudlinux.com> - 8.4.0-0.rc3
changelog:
  - ALTPHP-1880: Updated to RC3.
  - ALTPHP-1860: Remove deprecated sid_length and sid_bits settings.
  - Disabled thread safety by default.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.4.18-3
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php84/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.4.22-8
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php84-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.24-1
changelog:
  - Update to 8.4.24
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.4.24-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php84-fpm from alt-php84-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php84/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php84-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php84-php-fpm rather than
    alt-php84-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.4.17-1
changelog:
  - ALTPHP-2280: Update to 8.4.17 version
  - build percona5.7 without stick to version of alt-php
  - rollback building mysql5.6 for CL9


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-3
changelog:
  - ALTPHP-1935: Added xhprof in separate package
  - ALTPHP-1946: Added bitset in separate package
  - ALTPHP-1947: Moved gearman to separate package
  - ALTPHP-1948: Moved geoip to separate package
  - ALTPHP-1949: Added htscanner in separate package
  - ALTPHP-1950: Moved inotify to separate package
  - ALTPHP-1951: Moved jsmin to separate package
  - ALTPHP-1952: Added leveldb in separate package


author: Sergey Fokin <sfokin@cloudlinux.com> - 1-4
changelog:
  - ALTPHP-2043: add to requires:
      alt-php84-newrelic
      alt-php84-pecl-gender
      alt-php84-pecl-propro


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1-4.1
changelog:
  - ALTPHP-2053: Added alt-php84-pspell to requires.
  - Added libssh2-devel for requires, becase ssh2 module requires it.


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 1-5
changelog:
  - ALTPHP-1960: Moved ssh2 to separate package
  - ALTPHP-1954: Moved lzf to separate package
  - ALTPHP-1955: Moved mailparse to separate package
  - ALTPHP-1962: Moved yaf to separate package
  - ALTPHP-2050  Added dependency to new xdiff extension
  - ALTPHP-1953: Moved libsodium to separate package
  - ALTPHP-1958: Moved psr to separate package
  - ALTPHP-1961: Moved vips to separate package, now vips is supported on CL8 and CL9
  - ALTPHP-1956: Moved mcrypt to separate package
  - ALTPHP-2063: Removed unsupported propro extension


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 4.2.6-3
changelog:
  - Use PECL version instead of testing one
  - ALTPHP-2063: Add obsoletes for alt-php-pecl-propro on PHP8


author: Ilya Voyskovsky <ivoyskovsky@cloudlinux.com> - 8.5.3-4
changelog:
  - EA4D-782: Ensure /opt/cpanel/alt-php85/root/usr/var/run/php-fpm path is traversable by all users
    (post-install chmod o+X on path components when dirs were created before package install)


author: Lizi Ekseulidze <lekseulidze@cloudlinux.com> - 8.5.7-7
changelog:
  - ALTPHP-2518: on el7, link mbstring against alt-oniguruma instead of the
    system oniguruma. Build with PKG_CONFIG_PATH and RPATH pointing at
    /opt/alt/oniguruma and require alt-oniguruma. Fixes the unresolvable
    "libonig.so.5()(64bit)" dependency when installing alt-php85-mbstring on
    el7-family bases whose system oniguruma is older than 6.x (e.g. Amazon
    Linux 2, which ships oniguruma 5.9.6 providing only libonig.so.2). el8/el9
    keep using the system oniguruma, which already provides libonig.so.5.


author: CloudLinux Packaging Team <packager@cloudlinux.com> - 8.5.9-1
changelog:
  - Update to 8.5.9
  - ALTPHP-2543: add brotli-devel build dependency on el7/el8 so pkg-config can
    resolve libcurl's brotli requirement (alt-curlssl11 is built --with-brotli);
    RPM counterpart of the libbrotli-dev build dependency already in debian/control


author: Sergey Fokin <sfokin@cloudlinux.com> - 8.5.9-2
changelog:
  - ALTEAPLN-3: drop the hard Requires on alt-php85-fpm from alt-php85-cli, so
    the FPM package can be removed on servers that only use PHP Selector via
    lsapi. The alt-php group still installs it by default
  - ALTEAPLN-15: stop shipping the empty
    /opt/cpanel/alt-php85/root/etc/php-fpm.d/_.conf placeholder as a packaged
    file. cPanel reads any *.conf there as an enabled FPM pool and kept
    restarting alt-php85-fpm on servers that never use FPM. It is now a
    ghost entry that the post-install scriptlet creates only when cPanel is
    absent, where it still silences php-fpm's include-glob warning. Creating
    it instead of shipping-then-deleting also keeps package verification
    clean: the old approach left every cPanel server reporting the file as
    missing. The placeholder now belongs to alt-php85-php-fpm rather than
    alt-php85-common, since it exists only to silence a php-fpm warning, and
    on Debian the new -php-fpm postrm deletes it on package removal, which
    dpkg cannot do for a file no package owns.
    The ghost entry now carries an explicit 0644 mode, and both post-install
    scriptlets create the file with exactly that mode, because rpm verifies the
    mode of a ghost file even though it skips the existence and digest checks.
    The recorded user and group are left as this version already had them
    The default www pool is removed on cPanel hosts too, the same way as
    _.conf. cPanel writes its own per-domain pool under
    /opt/cpanel/alt-phpXY/root/etc/php-fpm.d when FPM is enabled through its
    API - verified serving a request with SAPI fpm-fcgi from that pool alone -
    so the shipped default pool was only letting the service run on hosts that
    never use FPM. It is still shipped and used off cPanel
  - ALTEAPLN-33: set rotate 7 in the FPM logrotate config. It carried no
    rotate directive, so logrotate applied its default of 0 and deleted the
    previous log on every rotation, leaving no error-log history at all.
    Found while adding this config to php53-55, which had none


author: Denis Kirjanov <dkirjanov@cloudlinux.com> - 2.1-11
changelog:
  - KMODLVE-553 liblve debian packaging fix
  - CAG-1221: make CageFS namespaces persistent
  - KMODLVE-549 secureio symbol visible fixes
  - KMODLVE-548 lto build fix
  - KMODLVE-536  lto support
  - KMODLVE-544: make lve* functions work without LVE
  - KMODLVE-521 cl9 support
  - CAG-1208: implement entering CageFS without LVE
  - CAG-1208: implement CageFS without LVE


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com>, nkeshelava <nkeshelava@cloudlinux.com> - 2.2-1

changelog:
  - CLOS-3672: Implementation for website isolation feature
  - CLOS-3755: Apply per user mounts to website isolation
  - CLOS-3719: Setup /tmp for website isolation feature
  - CLOS-3772: Optimize mount calls for website isolation
  - CLOS-3764: Add caching of website isolation namespaces
  - CLOS-3717: Drop capabilities only when present


author: Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> - 2.2-2
changelog:
  - CLOS-3912: Add NULL pointer validation in jail functions to prevent crashes
  - CLOS-3942: Fix failure on Solo when process cannot enter CageFS


author:
  Oleksandr Shyshatkyi <oshyshatskyi@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 2.2-4

changelog:
  - CLOS-3996: Consolidate domain ID registry into universal C module with Python bindings
  - CLOS-3964: Implemented hierarchical LVP support in lve-kmod


author: Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> - 2.2-6
changelog:
  - CLOS-4382: Skip cgroup-v1 mount loop in lve-kmod.sh on cgroup-v2 systems
  - CLOS-4343: Fix per-site namespace cache directory permissions in jail.c after a non-isolated request


author:
  Georgy Lepsaya <glepsaya@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com>, Sandro Kalatozishvili <skalatozishvili@cloudlinux.com> - 2.2-6

changelog:
  - CLOS-4382: Skip cgroup-v1 mount loop in lve-kmod.sh on cgroup-v2 systems
  - CLOS-4343: Fix per-site namespace cache directory permissions in jail.c after a non-isolated request
  - CLOS-4349: Fix website isolation on AlmaLinux 10 with stock httpd


author: Georgy Lepsaya <glepsaya@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> - 2.2-7
changelog:
  - CLOS-3536: Switch to alt-python-internal build-time dependency
  - CLOS-4366: propagate lve_root_setup rc and gate jail.c LVE override to per-domain range


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Nika Keshelava <nkeshelava@cloudlinux.com> - 2.2-8
changelog:
  - CLOS-4696: do not load kmodlve via lve.service while Intel IBT is active; defer until the post-reboot kernel has ibt=off, preventing a #CP panic
  - CLOS-4676: accept same-uid per-domain LVD id at the CageFS jail gate, fixing the ea-php php-fpm crash-loop on site-isolated pools
  - CLOS-5749: fix PHP under per-website isolation broken by current mod_hostinglimits (same liblve jail-gate fix)


author:
  oshyshatskyi <oshyshatskyi@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.3.7-1

changelog:
  - CLPRO-1395, CLPRO-1396: Add DirectAdmin support to AccelerateWP
  - CLPRO-1343: Fix bug in handling additional Plesk domains


author: Timur Kalimullin <tkalimullin@cloudlinux.com>, oshyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.8-1
changelog:
  - CLPRO-1405: Added method to return panel link to AccelerateWP page
  - CLPRO-1282: Implement automatic metrics discovery


author: Daniil Danilkin <ddanilkin@cloudlinux.com>, oshyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.9-1
changelog:
  - CLPRO-1377: Fixes MySQL UDS resolution from configs
  - CLPRO-1440: Remove 5-minute "edition checking" cron


author:
  Daniil Danilkin <ddanilkin@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.3.11-1

changelog:
  - CLPRO-1522: Fix nginx configuration parser
  - CLPRO-1613: Add support for quotes in DocumentRoot apache directive


author: Grigory Ponomarenko <gponomarenko@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.3.12-1
changelog:
  - CLOS-1996: Adapt CL Solo / CL Admin to work on Virtuozzo
  - CLPRO-1585: Add ability to activate AccelerateWP Premium from Centralized Monitoring
  - CLPRO-1531: Extend universal features list with required for unification


author: alutsiuk <alutsiuk@cloudlinux.com> 3.3.14-1
changelog:
  - CLPRO-1658: Improve remove cagefs mountpoint helper
  - CLPRO-1666: Extend clcaptain utility with AccelerateWP paths


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com>, Grigory Ponomarenko <gponomarenko@cloudlinux.com> 3.3.15-1

changelog:
  - CLPRO-1668: Added method for searching username by Plesk subscription
  - CLPRO-1657: Unify UI icons display defaults across all editions
  - CLOS-2227: Make Python/Nodejs Selector work on CL Solo
  - CLOS-2375: Add support for Apache mod_lsapi PRO on CL Solo


author: Roman Krompets <rkrompets@cloudlinux.com> 3.4.0-1
changelog:
  - CLPRO-1559: Added new panel features required for unification
  - CLPRO-1607: Added methods to detect if customer hitting hosting accounts limit
  - CLPRO-1825: Fixed permission issue for server flags directory
  - CLPRO-1872: Change ordering of edition features check
  - CLPRO-1823: Fix new autotracing feature is required on Vendor Panels


author:
  alutsiuk <alutsiuk@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.4.1-1

changelog:
  - CLPRO-1055: Extend CPAPI with suspended users list
  - CLPRO-1899: Added Sentry tag to detect WP2 environments
  - CLOS-2350: Add fault tolerance inside lvectl for when a UID cannot be found
  - CLPRO-1873: Internal refactoring: simplify code which detects supported features
  - CLPRO-1843: Improve logging of unexpected errors in code that gathers php data


author:
  Timur Kalimullin <tkalimullin@cloudlinux.com>, Oleksandr Shyshatskyi <oshyshatskyi@cloudlinux.com> 3.4.2-2

changelog:
  - CLPRO-1905: Add the ability to run the set-suite command asynchronously in configure_accelerate_wp
  - CLPRO-1996: Automatically clean DirectAdmin domains cache on changes in control panel


author: Vladimir Lebedev <vlebedev@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 3.4.3-1
changelog:
  - CLOS-2260: CL Shared Pro license is being detected as Solo on the server
  - CLOS-1860: Complete migration to Python 3.11


author: Vladimir Lebedev <vlebedev@cloudlinux.com> 3.4.4-1
changelog:
  - CLOS-1600: Handle UnicodeDecodeError when parsing configs containing broken utf-8
  - CLOS-2576: Make "secureio" module lazy-loadable and importable even in case of shared libraries absence


author: Mykola Ishchenko <mishchenko@cloudlinux.com>, Vladimir Lebedev <vlebedev@cloudlinux.com> 3.4.7-1
changelog:
  - CLOS-2597: Fix issue with MySQL connections on Ubuntu due to failing to find the socket file
  - CLPRO-1564: Fix get_domains_php_info on DirectAdmin when httpd.conf is huge


author: Denis Komandyr <dkomandyr@cloudlinux.com>, Dmitry Shibut <dshibut@cloudlinux.com> 3.4.12-1
changelog:
  - CLPRO-2238: Fix user count tracking in Sentry events
  - CLOS-2902: Ignore decimal points in CPU limits


author: alutsiuk <alutsiuk@cloudlinux.com>, Denis Komandyr <dkomandyr@cloudlinux.com> 3.4.13-1
changelog:
  - CLPRO-2238: Fix logging to stderr when failed to obtain machine ip and hostname
  - CLPRO-2292: Optimize wp cache plugin search


author: alutsiuk <alutsiuk@cloudlinux.com>, Timur Averianov <taverianov@cloudlinux.com> 3.4.15-1
changelog:
  - CLOS-3024: Fix MySQLConnector closing issues
  - CLPRO-2240: Turn off aggressive debug info for CMT requests


author: Dmitry Shibut <dshibut@cloudlinux.com> 3.4.16-1
changelog:
  - CLOS-2907: Improve error handling during the server flag statistics gathering process
  - CLPRO-2301: Fix getting php version for aliases on DirectAdmin


author:
  Dzmitry Ryzhykau <dryzhykau@cloudlinux.com>, Tamar Tsotniashvili <ttsotniashvili@cloudlinux.com> 3.4.17-1

changelog:
  - CLOS-2865: Remove fallback edition value when detecting current CL edition; return None when edition cannot be detected
  - CLOS-2896: Fix error in retrieving dblogin-username pairs on DirectAdmin when ONLY_FULL_GROUP_BY is active


author: Denis Komandyr <dkomandyr@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 3.4.18-1
changelog:
  - CLPRO-2480: Skip activation of Accelerate WP Free by Vendor config
  - CLOS-2083: Adapt cllib CL version retreival to handle Ubuntu versions


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.4.19-1
changelog:
  - CLOS-3122: Fix package presence detection logic on Ubuntu
  - CLPRO-2527: Fix cloudlinux-summary WordPress statistics collection


author: alutsiuk <alutsiuk@cloudlinux.com> 3.4.20-1
changelog:
  - CLPRO-2566: Unlocked CLPRO features for Ubuntu
  - CLPRO-2566: Fix alt-php modules dir detection
  - CLPRO-2533: Adapt accelerate-wp installation for Ubuntu22


author: Dzmitry Ryzhykau <dryzhykau@cloudlinux.com> 3.4.24-1
changelog:
  - CLOS-2881: Fix CageFS detection (clcommon.clcagefs.in_cagefs) when /var/.cagefs exists in the real file system


author: Roman Krompets <rkrompets@cloudlinux.com> 3.4.26-1
changelog:
  - CLPRO-2201: Unbind accelerate-wp from X-Ray
  - CLOS-3323: Revert to previous in_cagefs() logic based on /var/.cagefs check


author: Danila Vershinin <dvershinin@icloud.com>, Roman Suvorov <rsuvorov@cloudlinux.com> 3.4.27-1
changelog:
  - MAXWS-480: Add parameter "environment" to function clsentry.init_sentry_sdk_client
  - MAXWS-448: Added useraddondomains() for cPanel


author: mikalai <mvoina@cloudlinux.com>, alutsiuk <alutsiuk@cloudlinux.com> 3.4.29-1
changelog:
  - CLOS-2699: Fix traceback in physical_hosting_updated after modifying a domain on Plesk
  - MAXWS-598: add hooks interface for account suspension/unsuspension


author: Nika Keshelava <nkeshelava@cloudlinux.com>, Roman Prilipskii <rprilipskii@cloudlinux.com> 3.4.30-1
changelog:
  - CLOS-3303: Spread the load of 5-minute cron jobs to prevent resource usage spikes
  - CLOS-3523: Modify the OS detection logic to identify CL10 machines correctly


author: Roman Prilipskii <rprilipskii@cloudlinux.com>, Ruslan Koliada <rkoliada@cloudlinux.com> 3.4.34-1
changelog:
  - CLOS-3849: Correct LVE availability detection under user environments in cagefs
  - CLPRO-2819: Fix performance issue in _docroot_under_root


author:
  Andrei Zheregelia <azheregelia@cloudlinux.com>, Anastasia Lutsiuk <alutsiuk@cloudlinux.com> 3.4.40-1

changelog:
  - CLOS-4128, CLOS-4280: internal bugfixes
  - CLOS-4470: Fix hook name/domain validation failures for Unicode inputs on Plesk


author: Andrei Zheregelia <azheregelia@cloudlinux.com> 3.4.41-1
changelog:
  - CLOS-4593: internal bugfixes
  - CLOS-4742: Fix LVE metrics collection stopping when a control panel integration script runs long


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.10.13-1
changelog:
  - ALTPYTH-486: Updated to 3.10.12
  - ALTPYTH-478: fixed pam authentication through ssl
  - ALTPYTH-481: Updated to 3.10.13


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.10.20-2
changelog:
  - CVE-2025-15366: reject control characters in imaplib IMAP4 commands
  - CVE-2025-15367: reject control characters in poplib POP3 commands
  - CVE-2026-3644: reject control characters in http.cookies Morsel.update(), |=, unpickling and js_output
  - CVE-2026-4224: add recursion guard to pyexpat conv_content_model() to prevent C stack overflow
  - CVE-2026-4519: reject webbrowser URLs with a leading dash to prevent argument injection


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.10.20-3
changelog:
  - CVE-2026-4786: fix action-substitution bypass of the CVE-2026-4519 webbrowser dash-prefix check
  - CVE-2026-6100: clear decompressor next_in on the error path in bz2/lzma to prevent use-after-free
  - CVE-2026-7210: use XML_SetHashSalt16Bytes for 16-byte Expat hash-flooding entropy
  - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (Debian/Ubuntu, el7) so the CVE-2026-7210 16-byte salt path is not inert
  - CVE-2026-9669: refuse bz2 decompressor reuse after a previous error to prevent stack buffer overflow


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.10.20-4
changelog:
  - CVE-2026-15308: fix quadratic-complexity CPU DoS in html.parser.HTMLParser incremental parsing of long unterminated constructs


author: Viktor Borzov <vborzov@cloudlinux.com> - 3.10.20-5
changelog:
  - CVE-2025-1795: email address-list folding no longer RFC 2047-encodes the comma list separator (header spoofing)
  - CVE-2025-13462: tarfile no longer normalizes AREGTYPE to DIRTYPE while parsing GNU long-name/long-link multi-block members


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 3.10.20-6
changelog:
  - CVE-2026-8328: use the source server's peer address instead of its self-reported PASV address in ftplib.ftpcp() to prevent SSRF
  - CVE-2026-7774: validate the normalized link target written to disk in the tarfile data extraction filter to prevent writes outside the destination directory


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 3.10.20-7
changelog:
  - CVE-2025-12781: warn when base64 b64decode() and urlsafe_b64decode() accept '+' or '/' characters that are not part of the alternative alphabet in use
  - CVE-2026-1502: reject CR/LF and other control characters in the http.client proxy CONNECT tunnel host and request headers to prevent request smuggling


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 3.10.20-8
changelog:
  - CVE-2026-3276: fix quadratic-complexity CPU DoS in unicodedata.normalize() by replacing the O(n^2) canonical-ordering swap with a hybrid insertion/counting sort
  - CVE-2026-0864: normalize CR/CRLF/LF line endings when writing configparser values to prevent injection of unexpected keys and values
  - CVE-2026-11972: break at EOF in tarfile._Stream.seek() to prevent CPU DoS when parsing streaming-mode (mode="r|") archives


author: Arseniy Zolotarev <azolotarev@cloudlinux.com> - 3.10.20-9
changelog:
  - CVE-2026-3446: stop ignoring excess base64 data after the first padded quad in binascii.a2b_base64(), which backs base64.b64decode()
  - CVE-2026-11940: revalidate the hardlink's own shallower path in the tarfile extraction fallback so a symlink cannot escape the destination directory, and pass the extraction filter from extract() down to _extract_one() so the revalidation runs for single-member extraction as well and not only for extractall()
  - CVE-2026-6019: percent-encode the cookie value embedded in the http.cookies Morsel.js_output() script snippet and decode it with decodeURIComponent() to prevent breaking out of the script element while keeping UTF-8 values intact


author: Viktor Borzov <vborzov@cloudlinux.com> - 3.10.20-10
changelog:
  - CVE-2026-6879: cache the indexed sibling lookup in xml.etree.ElementPath predicate selection so Element.findall() and fully-consumed Element.iterfind() with an XPath index predicate no longer call parent.findall() once per matching sibling, removing the O(n^2) CPU DoS on documents with many same-tag siblings


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.10.21-1
changelog:
  - ALTPYTH-616: Update to 3.10.21
  - Drop 06003-ssl-use-bio_eof-for-asn1-cadata-eof.patch, included in upstream 3.10.21
  - Drop CVE backports included in upstream 3.10.21: CVE-2026-3644, CVE-2026-4224,
    CVE-2026-4519, CVE-2026-4786, CVE-2026-6100, CVE-2026-9669, CVE-2026-41080,
    CVE-2026-15308, CVE-2025-13462, CVE-2026-8328, CVE-2026-7774, CVE-2026-1502,
    CVE-2026-3276, CVE-2026-0864, CVE-2026-11972, CVE-2026-11940, CVE-2026-6879
  - Require expat >= 2.4.0 on rhel > 7: 3.10.21 calls
    XML_SetBillionLaughsAttackProtectionActivationThreshold and
    ...MaximumAmplification, which are required (non-weak) symbols in pyexpat.
    libexpat has no symbol versioning, so RPM records only libexpat.so.1()(64bit)
    and cannot derive the floor; on an older expat the package installs and then
    fails at import with "undefined symbol". CL7 keeps the bundled expat
  - Re-anchor the Include/pyexpat.h hunk of CVE-2026-7210.patch onto the 3.10.21
    PyExpat_CAPI layout (3.10.21 inserted the SetBillionLaughsAttackProtection*
    members before the end-of-struct sentinel) so it applies with --fuzz=0


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.11.15-2
changelog:
  - CVE-2025-15366: reject control characters in imaplib IMAP4._command() to prevent command injection
  - CVE-2025-15367: reject control characters in poplib POP3._putcmd() to prevent command injection
  - CVE-2026-3644: reject control characters in http.cookies Morsel.update(), |=, unpickling and js_output()
  - CVE-2026-4224: avoid unbounded C recursion in pyexpat conv_content_model() (C stack overflow)
  - CVE-2026-4519: reject leading dashes in URLs passed to webbrowser.open()


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.11.15-3
changelog:
  - CVE-2026-4786: reject action-token-expanded dash-prefixed args in webbrowser.open() (CVE-2026-4519 bypass)
  - CVE-2026-6100: fix dangling next_in pointer (UAF) in bz2/lzma decompressors after MemoryError on reuse
  - CVE-2026-7210: use XML_SetHashSalt16Bytes 16-byte entropy for Expat hash-flooding protection when available
  - CVE-2026-41080: backport libexpat XML_SetHashSalt16Bytes into the bundled expat (ubuntu16.04 / el7; other platforms link system expat) so the CVE-2026-7210 16-byte salt path is not inert
  - CVE-2026-9669: prevent bz2.BZ2Decompressor reuse after a decompression error (stack buffer overflow)


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.11.15-4
changelog:
  - CVE-2026-15308: fix quadratic complexity in html.parser.HTMLParser incremental parsing of long unterminated markup declarations (CPU denial-of-service)


author: Vladimir D. Seleznev <vseleznev@cloudlinux.com> - 3.11.15-5
changelog:
  - CVE-2026-0864: normalize CR/CRLF line endings in configparser writes to prevent key/value injection
  - CVE-2026-1502: reject CR/LF in http.client proxy CONNECT tunnel host and headers
  - CVE-2026-3276: fix O(n^2) canonical ordering in unicodedata.normalize() (DoS on crafted combining sequences)
  - CVE-2026-6019: percent-encode cookie values embedded in http.cookies js_output() to prevent script injection (XSS)
  - CVE-2026-7774: validate written link target in tarfile data filter to prevent path traversal
  - CVE-2026-8328: apply CVE-2021-4189 PASV peer-address check to ftplib.ftpcp() to prevent data-connection SSRF
  - CVE-2026-11940: fix symlink escape via tarfile hardlink-extraction fallback (path traversal)
  - CVE-2026-11972: make tarfile._Stream.seek() break at EOF to prevent infinite-loop DoS on crafted stream archives


author: Viktor Borzov <vborzov@cloudlinux.com> - 3.11.15-6
changelog:
  - CVE-2025-13462: skip tarfile AREGTYPE->DIRTYPE normalization while parsing GNU long name/link continuation headers (parser-differential)


author: Viktor Borzov <vborzov@cloudlinux.com> - 3.11.15-7
changelog:
  - CVE-2026-4360: apply the selected extraction filter when tarfile.TarFile.extract() falls back to extracting a hardlink target, instead of extracting it unfiltered (extraction filter bypass)
  - CVE-2026-6879: fix quadratic complexity in xml.etree XPath index predicates by memoising the indexed match per parent and tag (CPU denial-of-service)


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.11.16-1
changelog:
  - ALTPYTH-617: Update to 3.11.16 version
  - Drop patches absorbed by upstream 3.11.16: 06003-ssl-use-bio_eof-for-asn1-cadata-eof,
    CVE-2025-13462, CVE-2026-0864, CVE-2026-1502, CVE-2026-3276, CVE-2026-3644, CVE-2026-4224,
    CVE-2026-4360, CVE-2026-4519, CVE-2026-4786, CVE-2026-6100, CVE-2026-6879, CVE-2026-7774,
    CVE-2026-8328, CVE-2026-9669, CVE-2026-11940, CVE-2026-11972, CVE-2026-15308, CVE-2026-41080
  - Keep CVE-2026-7210, reduced to Modules/pyexpat.c: upstream's 16-byte Expat hash salt is
    gated on the libexpat HEADER version (XML_COMBINED_VERSION >= 20800), but ELS libexpat
    backports XML_SetHashSalt16Bytes into 2.2.x/2.5.x without bumping its version macros, so
    that gate is false and CPython would silently fall back to the 8-byte salt on el8, el9,
    debian10, ubuntu18.04 and ubuntu20.04. The patch restores the weak-symbol check on the
    function's address. No-op where the header really is 2.8.0+ (el7 and ubuntu16.04 use the
    bundled libexpat, now 2.8.3; debian13's system libexpat is 2.8.3)


author: Davit Sargsyan <dsargsyan@cloudlinux.com> - 3.14.3-1
changelog:
  - ALTPYTH-587: Update to Python 3.14.3
  - CVE-2025-15367: fix poplib command injection
  - CVE-2025-15366: Reject control characters in IMAP commands


author: Levon Matshkalyan <lmatshkalyan@cloudlinux.com> - 3.14.7-1
changelog:
  - ALTPYTH-614: Update to 3.14.7 version
  - Drop 00474 imaplib patch: CVE-2025-15366 is fixed upstream in 3.14.7
  - Fix stale bundled pip version in the bootstrap-only Provides (24.2 -> 26.2.1)


author: Davit Sargsyan <dsargsyan@cloudlinux.com> - 0.45.1-1
changelog:
  - ALTPYTH-587: Update to upstream wheel 0.45.1 for Python 3.14
  - CVE-2026-24049 : fix path traversal in wheel unpack


author: Eduard Chiganov <echiganov@cloudlinux.com> - 0.28.1-8
changelog:
  - ALTPYTH-467: Get rid of alt-python dependencies errors.
  - New linksafe post, triggerin and triggerun scripts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 1.2.2-7
changelog:
  - ALTPYTH-464: Fixed failed dependecies through update of filter.
  - New linksafe post, triggerin and triggerun scripts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 20.2.4-5
changelog:
  - ALTPYTH-458: Fix dependency error while install alt-python37.
  - New filter for provides, new post scriplets


author: Sergey Fokin <sfokin@cloudlinux.com> 3.8.12-2
changelog:
  - ALTPYTH-413: move -fno-semantic-interposition to CFLAGS_NODIST
  - remove changing gcc to devtoolset-gcc
  - change BuildRequire from gcc-toolset to system gcc for CL8


author: Eduard Chiganov <echiganov@cloudlinux.com> - 4.2.0-3
changelog:
  - ALTPYTH-474: Change specs for alt-python for new linksafe add method.
  - Created patch for unit tests.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.4.10-15
changelog:
  - ALR-140: Fixed mistake in net-telnet version description (epoch added).
  - Conflicts dependencies added.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.6.10-9
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - Conflicts dependencies added.
  - ALR-150: Updated to 2.6.10-9 release to prevent rubygems version conflicts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.7.6-138
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - ALR-149: Patch for ipaddr fixed.
  - ALR-151: Update to 2.7.6 version
  - Conflicts dependencies added.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.0.4-161
changelog:
  - ALR-153: Updated to 3.0.4
  - Patch 23 (Fix-stack-buffer-overflow) disabled because fixed in upstream.
  - Broken symlink in ruby-libs deleted.


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.0-2.cloudlinux
changelog:
  - AP2NGX-47: proxy_pass statistics added
  - AP2NGX-61: License check added
  - AP2NGX-63: Domain proxy error bug fixed
  - minor fixes


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.0-4.cloudlinux
changelog:
  - AP2NGX-72: Improved conversion reliability by handling more exceptions, and RewriteRule without substitution


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.0-5.cloudlinux
changelog:
  - AP2NGX-66: Ensured proxy_pass configuration has priority over any other configuration, when applied
  - Added command list-proxied to list all proxied domains
  - Fixed an issue where duplicate directives were added


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.0-6.cloudlinux
changelog:
  - AP2NGX-74: Fixed an issue where proxy_pass to Apache location caused duplication error
  - Preliminary support for NGINX LSAPI module


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.0-7.cloudlinux
changelog:
  - AP2NGX-78: Fixed redirect loop when setting proxy_pass to Apache
  - AP2NGX-80: Automatic rollback to "reset" state if there are problems in setup
  - AP2NGX-71: Add to APACHE2NGINX support of htaccess lsapi and PHP-FPM directives
  - AP2NGX-82: Add support of lsapi_phpini and related options to Apache2Nginx
  - AP2NGX-85: Add Sentry support to Apache2Nginx
  - AP2NGX-86: Ensure LSAPI NGINX module is installed during setup command.
  - AP2NGX-94: Make try_files more in line with Apache behavior


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.1-1.cloudlinux
changelog:
  - AP2NGX-103: Updated to Python 3.11 and cloudlinux-venv
  - AP2NGX-103: Modified to install to sbin directory
  - AP2NGX-98: Added try_files by default that is used for failed
  - AP2NGX-99: Ensure that the test file mime.types is packaged


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.2-2.cloudlinux
changelog:
  - AP2NGX-133: Ensure that the cl-ea4-experimental repository is enabled during setup, to pick up ea-nginx-standalone package


author: Danila Vershinin <dvershinin@cloudlinux.com> - 1.3-3.cloudlinux
changelog:
  - AP2NGX-167: Enabled Coraza-based WAF in Imunify360 Webshield
  - AP2NGX-209: Always install WAF connector module and fix path to clmonitor program


author: Martin Krcho <mkrcho@cloudlinux.com> - 30.1.6-1
changelog:
  - WordPress: detect active/inactive status of plugins and themes (DEF-47518)
  - WordPress: detect must-use (MU) plugins (DEF-47519)
  - Report per-scan duration in the stats payload and SQLite report (DEF-48604)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 30.1.8-1
changelog:
  - Report the detector version in the stats payload (DEF-51827)
  - Persist the last scan run outcome to a local status file (DEF-51827)


author: Dmitriy Leonov <dmleonov@cloudlinux.com> - 30.1.9-1
changelog:
  - Require the php-internal mysqlnd and process packages the wrapper loads (DEF-53808)
  - Fixes PHP startup warnings mailed to root by the monthly cron on hosts missing them
  - Makes WordPress plugin/theme activation-status detection work on all hosts


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els35]
changelog:
  - ptrace: require CAP_SYS_PTRACE when task has no mm
  - net: udp_offload: propagate SKBFL_SHARED_FRAG in skb_gro_receive_list {CVE-2026-46300}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els1]
changelog:
  - perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
  - x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
  - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
  - dm: remove fake timeout to avoid leak request {CVE-2026-43314}
  - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
  - drm: Account property blob allocations to memcg {CVE-2026-43287}
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
  - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-39677}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120}
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() {CVE-2025-39876}
  - espintcp: fix skb leaks {CVE-2025-38057}
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() {CVE-2025-37824}
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
  - virtiofs: add filesystem context source name check {CVE-2025-37773}
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
  - ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
  - wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
  - wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097}
  - net/sctp: Prevent autoclose integer overflow in sctp_association_init() {CVE-2024-57938}
  - ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172}
  - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() {CVE-2024-56369}
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware {CVE-2024-53157}
  - vsock: Fix sk_error_queue memory leak {CVE-2024-53118}
  - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof {CVE-2024-53113}
  - exec: don't WARN for racy path_noexec check {CVE-2024-50010}
  - drm/amd/display: Initialize get_bytes_per_element's default to 1 {CVE-2024-49892}
  - ppp: do not assume bh is held in ppp_channel_bridge_input() {CVE-2024-49946}
  - drm/amd/display: Skip Recompute DSC Params if no Stream on Link {CVE-2024-47683}
  - x86/sgx: Fix deadlock in SGX NUMA node search {CVE-2024-49856}
  - pktgen: use cpus_read_lock() in pg_net_init() {CVE-2024-46681}
  - nfsd: call cache_put if xdr_reserve_space returns NULL {CVE-2024-47737}
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
  - drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
  - net/mlx5: Fix bridge mode operations when there are no VFs {CVE-2024-46857}
  - Input: MT - limit max slots {CVE-2024-45008}
  - net/mlx5e: SHAMPO, Fix incorrect page release {CVE-2024-46717}
  - netfilter: ctnetlink: use helper function to calculate expect ID {CVE-2024-44944}
  - lib: objagg: Fix general protection fault {CVE-2024-43846}
  - drm/qxl: Add check for drm_cvt_mode {CVE-2024-43829}
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems {CVE-2024-42073}
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes {CVE-2024-42101}
  - RDMA/mlx5: Add check for srq max_sge attribute {CVE-2024-40990}
  - tracing: Build event generation tests only as modules {CVE-2024-41004}
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() {CVE-2024-36967}
  - epoll: be better about file lifetimes {CVE-2024-38580}
  - drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer {CVE-2023-54274}
  - x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction {CVE-2023-54172}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
  - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected {CVE-2024-26891}
  - dm: don't attempt to queue IO under RCU protection {CVE-2023-53860}
  - md: fix soft lockup in status_resync {CVE-2023-53620}
  - spi: qup: Don't skip cleanup in remove's error path {CVE-2023-53567}
  - md/raid10: prevent soft lockup while flush writes {CVE-2023-53151}
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() {CVE-2023-53133}
  - spi: imx: Don't skip cleanup in remove's error path {CVE-2023-53225}
  - xsk: Add missing overflow check in xdp_umem_reg {CVE-2023-53080}
  - wifi: mt76: do not run mt76u_status_worker if the device is not running {CVE-2022-50735}
  - bpf: Skip task with pid=1 in send_signal_common() {CVE-2023-52992}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() {CVE-2023-52702}
  - RDMA/irdma: Fix potential NULL-ptr-dereference {CVE-2023-52744}
  - i2c: designware: Fix handling of real but unexpected device interrupts {CVE-2022-50370}
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() {CVE-2022-50544}
  - tpm: acpi: Call acpi_put_table() to fix memory leak {CVE-2022-50562}
  - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed {CVE-2022-50500}
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
  - blk-mq: fix possible memleak when register 'hctx' failed {CVE-2022-50434}
  - ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() {CVE-2022-49885}
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989}
  - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE {CVE-2022-49875}
  - can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
  - ovl: Use "buf" flexible array for memcpy() destination {CVE-2022-49743}
  - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() {CVE-2022-49839}
  - net: bcmgenet: Use stronger register read/writes to assure ordering {CVE-2022-49194}
  - ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
  - net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743}
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" {CVE-2025-71137}
  - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
  - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
  - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455}
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
  - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
  - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}
  - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
  - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els2]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
  - cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
  - scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
  - drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
  - tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
  - clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
  - drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
  - bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
  - driver core: fix resource leak in device_add() {CVE-2023-53594}
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
  - wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
  - drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
  - ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
  - tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
  - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
  - can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
  - serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
  - cpufreq: exit() callback is optional {CVE-2024-38615}
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
  - wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
  - tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
  - net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
  - wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
  - calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
  - ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
  - RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
  - net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
  - nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
  - rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
  - net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
  - coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
  - scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
  - scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
  - usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
  - drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
  - USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
  - PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
  - drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
  - drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
  - USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
  - media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
  - arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
  - bnxt: Do not read past the end of test names {CVE-2023-53010}
  - dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE {CVE-2024-42321}
  - PCI: Fix use-after-free of slot->bus on hot remove {CVE-2024-53194}
  - net/ipv6: release expired exception dst cached in socket {CVE-2024-56644}
  - net: sched: fix ordering of qlen adjustment {CVE-2024-53164}
  - watch_queue: Fix NULL dereference in error cleanup {CVE-2022-49257}
  - lz4: fix LZ4_decompress_safe_partial read out of bound {CVE-2022-49078}
  - vmxnet3: disable rx data ring on dma allocation failure {CVE-2024-40923}
  - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() {CVE-2024-36955}
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure {CVE-2022-50374}
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag {CVE-2024-35817}
  - dm snapshot: fix lockup in dm_exception_table_exit {CVE-2024-35805}
  - nouveau: fix instmem race condition around ptr stores {CVE-2024-26984}
  - wireguard: netlink: access device through ctx instead of peer {CVE-2024-26950}
  - drm/i915/gt: Reset queue_priority_hint on parking {CVE-2024-26937}
  - netfilter: nft_set_pipapo: do not free live element {CVE-2024-26924}
  - dmaengine: fix NULL pointer in channel unregistration function {CVE-2023-52492}
  - PCI/PM: Drain runtime-idle callbacks before driver removal {CVE-2024-35809}
  - nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
  - phylib: fix potential use-after-free {CVE-2022-48754}
  - mm/filemap: skip to create PMD-sized page cache if needed {CVE-2024-41031}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() {CVE-2024-35944}
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage {CVE-2024-36006}
  - wifi: ath11k: decrease MHI channel buffer length to 8KB {CVE-2024-35938}
  - dyndbg: fix old BUG_ON in >control parser {CVE-2024-35947}
  - ALSA: core: Fix NULL module pointer assignment at card init {CVE-2024-38605}
  - wifi: iwlwifi: mvm: rfi: fix potential response leaks {CVE-2024-35912}
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD {CVE-2024-35801}
  - ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() {CVE-2023-52832}
  - i2c: core: Run atomic i2c xfer when !preemptible {CVE-2023-52791}
  - mmc: sdio: fix possible resource leaks in some error paths {CVE-2023-52730}
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions {CVE-2024-42265}
  - wifi: mac80211: fix potential sta-link leak {CVE-2024-35838}
  - octeontx2-af: avoid off-by-one read from userspace {CVE-2024-36957}
  - xen-netfront: Add missing skb_mark_for_recycle {CVE-2024-27393}
  - net: hns3: do not allow call hns3_nic_net_open repeatedly {CVE-2021-47400}
  - HID: sony: Fix a potential memory leak in sony_probe() {CVE-2023-52529}
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
  - mm/gup: fix gup_pud_range() for dax {CVE-2022-48986}
  - drm/virtio: Fix GEM handle creation UAF {CVE-2022-48899}
  - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() {CVE-2024-26894}
  - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}
  - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
  - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks {CVE-2026-23270}
  - net/sched: act_ct: fix skb leak and crash on ooo frags {CVE-2023-52610}
  - Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
  - mm/mempolicy: fix memory leak in set_mempolicy_home_node system call {CVE-2022-50391}
  - mm/kasan: fix double free for kasan pXds {CVE-2026-31686}
  - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
  - dax: Fix dax_mapping_release() use after free {CVE-2023-53613}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els3]
changelog:
  - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
  - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
  - cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
  - rcu: Fix rcu_read_unlock() deadloop due to softirq
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - RDMA/efa: Fix possible deadlock {CVE-2026-31493}
  - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
  - RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
  - RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
  - RDMA/efa: Extend admin timeout error print
  - RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
  - kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
  - wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
  - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
  - exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
  - af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
  - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
  - udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
  - efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
  - kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
  - smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
  - drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
  - firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
  - ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
  - net: hinic: fix memory leak when reading function table {CVE-2022-50438}
  - device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
  - libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
  - usbnet: fix memory leak in error case {CVE-2022-49657}
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
  - seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
  - net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
  - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
  - leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
  - RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
  - tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
  - kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
  - i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
  - can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
  - regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
  - wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
  - can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
  - bpf: Fix memory leaks in __check_func_call {CVE-2022-49837}
  - configfs: fix a race in configfs_{,un}register_subsystem() {CVE-2022-48931}
  - RDMA/mad: Improve handling of timed out WRs of mad agent {CVE-2024-50095}
  - cifs: Fix connections leak when tlink setup failed {CVE-2022-49822}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() {CVE-2024-41097}
  - tcp: add sanity checks to rx zerocopy {CVE-2024-26640}
  - NFSD: Prevent a potential integer overflow {CVE-2024-53146}
  - bpf, cpumap: Handle skb as well when clean up ptr_ring {CVE-2023-53660}
  - team: fix null-ptr-deref when team device type is changed {CVE-2023-52574}
  - fbdev: efifb: Register sysfs groups through driver core {CVE-2024-49925}
  - bpf: devmap: provide rxq after redirect {CVE-2024-50162}
  - net: phy: micrel: Allow probing without .driver_data {CVE-2022-49472}
  - inotify: Avoid reporting event with invalid wd {CVE-2023-54119}
  - USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
  - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096}
  - RDMA/irdma: Fix data race on CQP request done {CVE-2023-54292}
  - fscache: Fix oops due to race with cookie_lru and use_cookie {CVE-2022-48989}
  - perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() {CVE-2023-52450}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c {CVE-2024-56727}
  - wifi: iwlwifi: fix debug actions order {CVE-2025-38045}
  - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' {CVE-2022-50553}
  - net: ipv4: fix one memleak in __inet_del_ifa() {CVE-2023-53995}
  - exfat: fix memory leak in exfat_load_bitmap() {CVE-2024-50013}
  - vp_vdpa: fix id_table array not null terminated error {CVE-2024-53110}
  - intel_th: Fix a resource leak in an error handling path {CVE-2022-50143}
  - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101}
  - usb: gadget: core: Check for unset descriptor {CVE-2024-44960}
  - drm/amdkfd: Fix lock dependency warning with srcu {CVE-2023-52632}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() {CVE-2025-38458}
  - PM / devfreq: Check governor before using governor->name {CVE-2025-38609}
  - tls: fix missing memory barrier in tls_init {CVE-2024-36489}
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() {CVE-2025-37830}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery {CVE-2024-40977}
  - nvdimm: Fix firmware activation deadlock scenarios {CVE-2022-49446}
  - wifi: mac80211: sdata can be NULL during AMPDU start {CVE-2022-48875}
  - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods {CVE-2022-49024}
  - wifi: ath10k: Fix memory leak in management tx {CVE-2024-50236}
  - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] {CVE-2025-21666}
  - netdevsim: fix memory leak in nsim_bus_dev_new() {CVE-2022-50772}
  - fs: relax assertions on failure to encode file handles {CVE-2024-57924}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c {CVE-2024-56707}
  - ceph: fix deadlock or deadcode of misusing dget() {CVE-2023-52583}
  - bpf, verifier: Fix memory leak in array reallocation for stack state {CVE-2022-49878}
  - ip6_gre: make ip6gre_header() robust {CVE-2025-71098}
  - ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
  - net/mlx5e: kTLS, Fix incorrect page refcounting {CVE-2024-53138}
  - gve: Clear napi->skb before dev_kfree_skb_any() {CVE-2024-40937}
  - atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt {CVE-2025-71131}
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration {CVE-2024-45006}
  - irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
  - CDC-NCM: avoid overflow in sanity checking {CVE-2022-48938}
  - Bluetooth: Fix crash when replugging CSR fake controllers {CVE-2022-48982}
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521}
  - ptp: Ensure info->enable callback is always set {CVE-2025-21814}
  - perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() {CVE-2022-50820}
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() {CVE-2022-50556}
  - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU {CVE-2023-54036}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
  - drm/amdgpu: Fix smatch static checker warning {CVE-2024-46835}
  - svcrdma: Address an integer overflow {CVE-2024-53151}
  - dma-debug: fix a possible deadlock on radix_lock {CVE-2024-47143}
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check {CVE-2024-41072}
  - regulator: core: fix use_count leakage when handling boot-on {CVE-2022-50250}
  - tpm: use try_get_ops() in tpm-space.c {CVE-2022-49286}
  - ata: libata-transport: fix error handling in ata_tdev_add() {CVE-2022-49823}
  - padata: Always leave BHs disabled when running ->parallel() {CVE-2022-50382}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
  - serial: core: check uartclk for zero to avoid divide by zero {CVE-2024-43893}
  - cifs: fix potential memory leaks in session setup {CVE-2023-53008}
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() {CVE-2023-54198}
  - nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() {CVE-2023-53697}
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() {CVE-2026-43136}
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
  - drm/ioc32: stop speculation on the drm_compat_ioctl path {CVE-2026-31781}
  - ext4: fix i_disksize exceeding i_size problem in paritally written case {CVE-2023-53270}
  - wifi: nl80211: fix NULL-ptr deref in offchan check {CVE-2023-53113}
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() {CVE-2023-53717}
  - ASoC: SOF: Add some bounds checking to firmware data {CVE-2024-26927}
  - regulator: core: Prevent integer underflow {CVE-2022-50582}
  - power: supply: fix null pointer dereferencing in power_supply_get_battery_info {CVE-2022-50276}
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
  - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
  - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
  - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
  - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els4]
changelog:
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c {CVE-2024-56726}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c {CVE-2024-56679}
  - USB: chipidea: fix memory leak with using debugfs_lookup() {CVE-2023-53334}
  - drivers: serial: jsm: fix some leaks in probe {CVE-2022-50312}
  - drm: amd: display: Fix memory leakage {CVE-2023-53605}
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent {CVE-2026-43026}
  - net: Drop the lock in skb_may_tx_timestamp() {CVE-2026-43216}
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
  - net: mdio: unexport __init-annotated mdio_bus_init() {CVE-2022-49350}
  - netfilter: ipset: Rework long task execution when adding/deleting entries {CVE-2023-53549}
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() {CVE-2023-53275}
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash {CVE-2022-50494}
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message {CVE-2026-23307}
  - usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
  - tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
  - cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() {CVE-2023-52942}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path {CVE-2023-52703}
  - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() {CVE-2022-50246}
  - bus: mhi: host: Range check CHDBOFF and ERDBOFF {CVE-2023-53598}
  - hwmon: (coretemp) Simplify platform device handling {CVE-2023-53612}
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
  - dm crypt: add cond_resched() to dmcrypt_write() {CVE-2023-53051}
  - xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() {CVE-2024-43879}
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() {CVE-2023-53335}
  - regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
  - HID: prodikeys: Check presence of pm->input_ep82 {CVE-2026-43251}
  - perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() {CVE-2022-50510}
  - wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
  - trace/blktrace: fix memory leak with using debugfs_lookup() {CVE-2023-53408}
  - dm-verity: correctly handle dm_bufio_client_create() failure {CVE-2026-43132}
  - pstore: ram_core: fix incorrect success return when vmap() fails {CVE-2026-43124}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk {CVE-2026-43043}
  - net: use skb_header_pointer() for TCPv4 GSO frag_off check {CVE-2026-43036}
  - scsi: mpi3mr: Fix config page DMA memory leak {CVE-2023-53120}
  - net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
  - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx {CVE-2023-53546}
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() {CVE-2025-37852}
  - bpf: Prevent decl_tag from being referenced in func_proto arg {CVE-2022-50883}
  - arm64: set __exception_irq_entry with __irq_entry as a default {CVE-2023-54322}
  - class: fix possible memory leak in __class_register() {CVE-2022-50578}
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found. {CVE-2024-27436}
  - net/mlx5: fix potential memory leak in mlx5e_init_rep_rx {CVE-2023-54106}
  - net/mlx5: E-Switch, Fix an Oops in error handling code {CVE-2023-53058}
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() {CVE-2023-53078}
  - ice: xsk: disable txq irq before flushing hw {CVE-2023-53102}
  - selinux: fix memleak in security_read_state_kernel() {CVE-2022-50201}
  - efi: runtime: Fix potential overflow of soft-reserved region size {CVE-2024-26843}
  - drm/amdgpu: Fix potential null pointer derefernce {CVE-2023-52814}
  - ata: libata-core: Fix null pointer dereference on error {CVE-2024-41098}
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs {CVE-2026-23286}
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() {CVE-2026-23304}
  - drm/amd/display: Fix system hang while resume with TBT monitor {CVE-2024-50003}
  - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator {CVE-2026-43085}
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION {CVE-2026-31590}
  - l2tp: Drop large packets with UDP encap {CVE-2026-43080}
  - tun: limit printing rate when illegal packet received by tun dev {CVE-2024-27013}
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event {CVE-2026-43167}
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding {CVE-2026-43315}
  - xenbus: Use kref to track req lifetime {CVE-2025-37949}
  - wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS {CVE-2024-46830}
  - scsi: smartpqi: Fix disable_managed_interrupts {CVE-2024-26742}
  - IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF {CVE-2023-52851}
  - vhost-vdpa: fix use after free in vhost_vdpa_probe() {CVE-2023-52795}
  - ndisc: ndisc_send_redirect() cleanup
  - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
  - ipv6: icmp: convert to dev_net_rcu()
  - ipv4: icmp: convert to dev_net_rcu()
  - ipv4: use RCU protection in __ip_rt_update_pmtu() {CVE-2025-21766}
  - ipv6: use RCU protection in ip6_default_advmss() {CVE-2025-21765}
  - fix: ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763}
  - arp: use RCU protection in arp_xmit() {CVE-2025-21762}
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761}
  - ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760}
  - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759}
  - ipv6: mcast: add RCU protection to mld_newpack() {CVE-2025-21758}
  - ipv4: use RCU protection in rt_is_expired()
  - ipv4: use RCU protection in inet_select_addr()
  - ipv4: add RCU protection to ip4_dst_hoplimit()
  - flow_dissector: use RCU protection to fetch dev_net()
  - net: add dev_net_rcu() helper
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency {CVE-2024-47696}
  - perf/x86/amd/core: Always clear status for idx {CVE-2023-53073}
  - tcp_bpf: fix return value of tcp_bpf_sendmsg() {CVE-2024-46783}
  - RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
  - drm/ttm: Fix a NULL pointer dereference {CVE-2023-53095}
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak {CVE-2026-43035}
  - fbcon: check return value of con2fb_acquire_newinfo() {CVE-2026-43123}
  - ipv4: prevent potential spectre v1 gadget in fib_metrics_match() {CVE-2023-52996}
  - perf/x86/intel/uncore: Skip discovery table for offline dies {CVE-2026-43079}
  - mm/page_alloc: clear page->private in free_pages_prepare() {CVE-2026-43303}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() {CVE-2026-23111}
  - netfilter: nf_tables: restore set elements when delete set fails {CVE-2024-27012}
  - drm/amdkfd: Correct the migration DMA map direction {CVE-2024-57897}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els5]
changelog:
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
  - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
  - bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
  - net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
  - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
  - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
  - net: Fix an unsafe loop on the list {CVE-2024-50024}
  - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
  - wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
  - serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
  - iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
  - octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
  - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
  - x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
  - ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
  - drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
  - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
  - fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
  - sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
  - dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
  - netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
  - tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
  - xen/netfront: stop tx queues during live migration {CVE-2022-48969}
  - Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
  - can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
  - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
  - cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
  - netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
  - drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
  - drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
  - trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
  - drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
  - bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
  - drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
  - ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
  - RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
  - usb: udc: remove warning when queue disabled ep {CVE-2024-35822}
  - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754}
  - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet {CVE-2024-56590}
  - tls: stop recv() if initial process_rx_list gave us non-DATA {CVE-2024-58239}
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path {CVE-2022-50482}
  - ext4: update s_journal_inum if it changes after journal replay {CVE-2023-53091}
  - cifs: Fix xid leak in cifs_copy_file_range() {CVE-2022-50643}
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit {CVE-2024-49938}
  - nbd: null check for nla_nest_start {CVE-2024-27025}
  - netfilter: ipset: Hold module reference while requesting a module {CVE-2024-56637}
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 {CVE-2024-46817}
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() {CVE-2026-31512}
  - Bluetooth: MGMT: Add error handling to pair_device() {CVE-2024-43884}
  - netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
  - nvme-pci: fix mempool alloc size {CVE-2022-50756}
  - fs: fix fd table size alignment properly {CVE-2024-45025}
  - gpio: sim: fix a memory leak {CVE-2023-52706}
  - ice: switch: fix potential memleak in ice_add_adv_recipe() {CVE-2022-48709}
  - netfilter: ebtables: fix memory leak when blob is malformed {CVE-2022-48641}
  - mfd: syscon: Fix null pointer dereference in of_syscon_register() {CVE-2023-52467}
  - netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
  - scsi: megaraid_sas: Fix for a potential deadlock {CVE-2024-57807}
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream {CVE-2023-52806}
  - drm/amd/display: Avoid NULL dereference of timing generator {CVE-2023-52753}
  - netfilter: nft_socket: fix sk refcount leaks {CVE-2024-46855}
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
  - objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
  - ceph: defer stopping mdsc delayed_work
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga {CVE-2023-52819}
  - rethook: fix a potential memleak in rethook_alloc() {CVE-2022-49795}
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() {CVE-2022-49787}
  - scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() {CVE-2023-53132}
  - cifs: fix small mempool leak in SMB2_negotiate() {CVE-2022-49938}
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() {CVE-2022-50191}
  - watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource {CVE-2022-50110}
  - drm/ttm: fix bulk_move corruption when adding a entry {CVE-2023-53444}
  - clk: Fix memory leak in devm_clk_notifier_register() {CVE-2023-53674}
  - md: raid1: fix potential OOB in raid1_remove_disk() {CVE-2023-53722}
  - wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU {CVE-2023-54052}
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags {CVE-2024-49923}
  - recordmcount: Fix memory leaks in the uwrite function {CVE-2023-53318}
  - crypto: cavium - prevent integer overflow loading firmware {CVE-2022-50330}
  - integrity: Fix memory leakage in keyring allocation error path {CVE-2022-50395}
  - mmc: toshsd: fix return value check of mmc_add_host() {CVE-2022-50886}
  - RDMA/efa: Fix wrong resources deallocation order {CVE-2023-54201}
  - inet: read sk->sk_family once in inet_recv_error() {CVE-2024-26679}
  - ALSA: pcm: Add sanity NULL check for the default mmap fault handler {CVE-2024-53180}
  - net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
  - net: usb: smsc95xx: Limit packet length to skb->len {CVE-2023-53062}
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() {CVE-2024-35930}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() {CVE-2024-43871}
  - rdma/cxgb4: Prevent potential integer overflow on 32bit {CVE-2024-57973}
  - ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects {CVE-2023-53708}
  - rxrpc: Fix missing locking causing hanging calls {CVE-2024-50294}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() {CVE-2024-50008}
  - ELF: fix kernel.randomize_va_space double read {CVE-2024-46826}
  - crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
  - drm/amd/pm: fix null pointer access {CVE-2025-38705}
  - ALSA: line6: Fix racy access to midibuf {CVE-2024-44954}
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection {CVE-2024-56532}
  - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node {CVE-2023-52662}
  - drm/amd/display: Initialize denominators' default to 1 {CVE-2024-49899}
  - ipmi: fix use after free in _ipmi_destroy_user() {CVE-2022-50677}
  - Bluetooth: Fix memory leak in hci_req_sync_complete() {CVE-2024-35978}
  - null_blk: fix validation of block size {CVE-2024-41077}
  - ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
  - cifs: Fix integer overflow while processing acregmax mount option {CVE-2025-21964}
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure {CVE-2025-37841}
  - nvmet-tcp: fix kernel crash if commands allocation fails {CVE-2024-46737}
  - netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() {CVE-2024-50259}
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses {CVE-2024-42247}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37770}
  - drm/sched: Increment job count before swapping tail spsc queue {CVE-2025-38515}
  - i2c: qup: jump out of the loop in case of timeout {CVE-2025-38671}
  - brcmfmac: return error when getting invalid max_flowrings from dongle {CVE-2022-50358}
  - PNP: fix name memory leak in pnp_alloc_dev() {CVE-2022-50278}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN {CVE-2025-38393}
  - regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37768}
  - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() {CVE-2022-49780}
  - RDMA/cm: Fix leaking the multicast GID table reference {CVE-2025-71084}
  - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
  - drop_monitor: fix incorrect initialization order {CVE-2025-21862}
  - wifi: nl80211: disallow setting special AP channel widths {CVE-2024-43912}
  - net/mlx5: Fix steering rules cleanup {CVE-2023-53079}
  - usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
  - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc {CVE-2024-58009}
  - fs/binfmt_elf: Fix memory leak in load_elf_binary() {CVE-2022-50466}
  - drm/amdgpu: set the right AMDGPU sg segment limitation {CVE-2024-56594}
  - bridge: mcast: Fix use-after-free during router port configuration {CVE-2025-38248}
  - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
  - fuse: reject oversized dirents in page cache {CVE-2026-31694}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
  - net/mlx5: Collect command failures data only for known commands {CVE-2023-53340}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
  - scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
  - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() {CVE-2024-47682}
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
  - nbd: fix race between timeout and normal completion {CVE-2024-49855}
  - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() {CVE-2025-21724}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els6]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
  - unshare: fix unshare_fs() handling {CVE-2026-43472}
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
  - dm: fix queue start/stop imbalance under suspend/load/resume races {CVE-2025-40134}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate() {CVE-2024-50006}
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe() {CVE-2024-53198}
  - HID: pidff: Fix null pointer dereference in pidff_find_fields {CVE-2025-37862}
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change {CVE-2023-53103}
  - NFS: Fix a potential data corruption {CVE-2023-53711}
  - NFS: Fix a use after free in nfs_direct_join_group() {CVE-2023-53711}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload {CVE-2024-36919}
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type {CVE-2023-52659}
  - Input: uinput - reject requests with unreasonable number of slots {CVE-2024-46745}
  - afs: Fix the maximum cell name length {CVE-2025-21646}
  - drm/i915: Avoid potential vm use-after-free {CVE-2023-52931}
  - interconnect: fix mem leak when freeing nodes {CVE-2023-53096}
  - drm/vkms: Fix memory leak in vkms_init() {CVE-2022-50269}
  - USB: dwc3: fix memory leak with using debugfs_lookup() {CVE-2023-53415}
  - mm/uffd: fix pte marker when fork() without fork event {CVE-2022-49744}
  - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() {CVE-2023-53696}
  - ipmi_si: fix a memleak in try_smi_init() {CVE-2023-53611}
  - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() {CVE-2024-58083}
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() {CVE-2024-36924}
  - firmware: cs_dsp: Validate payload length before processing block {CVE-2024-42237}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
  - ftrace: Avoid potential division by zero in function_stat_show() {CVE-2025-21898}
  - IB/core: Implement a limit on UMAD receive List {CVE-2024-42145}
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ {CVE-2024-27437}
  - netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type {CVE-2025-23161}
  - net: nexthop: Initialize all fields in dumped nexthops {CVE-2024-42283}
  - tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007}
  - net: tls: explicitly disallow disconnect {CVE-2025-37756}
  - KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
  - ext4: turn quotas off if mount failed after enabling quotas {CVE-2023-54153}
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
  - block: fix overflow in blk_ioctl_discard() {CVE-2024-36917}
  - usb: xhci: Check endpoint is valid before dereferencing it {CVE-2023-52901}
  - iio: core: fix memleak in iio_device_register_sysfs {CVE-2023-52643}
  - platform/x86/amd/pmc: Detect when STB is not available {CVE-2024-53072}
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() {CVE-2023-52939}
  - dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
  - bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
  - bonding: provide a net pointer to __skb_flow_dissect() {CVE-2026-23119}
  - rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164}
  - rtc: class: Fix potential memleak in devm_rtc_allocate_device() {CVE-2022-50477}
  - ice: fix memory leak in aRFS after reset {CVE-2025-21981}
  - bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
  - net: hns: fix possible memory leak in hnae_ae_register() {CVE-2022-50352}
  - team: better TEAM_OPTION_TYPE_STRING validation {CVE-2025-21787}
  - refscale: Fix uninitalized use of wait_queue_head_t {CVE-2023-54316}
  - opp: Fix use-after-free in lazy_opp_tables after probe deferral {CVE-2023-54026}
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust {CVE-2024-53122}
  - serial: 8250: fix panic due to PSLVERR {CVE-2025-39724}
  - perf: Fix sample vs do_exit() {CVE-2025-38424}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els7]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
  - Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
  - xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
  - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
  - net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
  - net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
  - net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
  - net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
  - net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
  - USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
  - USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
  - tpm: Cap the number of PCR banks {CVE-2025-71077}
  - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
  - dm: fix a race condition in retrieve_deps {CVE-2023-54324}
  - ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
  - mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
  - mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
  - bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
  - RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
  - trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
  - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
  - team: prevent adding a device which is already a team device lower {CVE-2024-58071}
  - net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
  - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
  - rxrpc: Fix handling of received connection abort {CVE-2024-58053}
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
  - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
  - net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
  - drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
  - dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
  - smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
  - PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
  - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
  - nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
  - cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
  - mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
  - memcg: fix soft lockup in the OOM process {CVE-2024-57977}
  - resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
  - r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
  - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
  - extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
  - tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
  - bridge: switchdev: Fix memory leaks when changing VLAN protocol {CVE-2022-49812}
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() {CVE-2022-49890}
  - net: genl: fix error path memory leak in policy dumping {CVE-2022-50042}
  - kprobes: don't call disarm_kprobe() for disabled kprobes {CVE-2022-50008}
  - lib/fonts: fix undefined behavior in bit shift for get_default_font {CVE-2022-50511}
  - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
  - arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored {CVE-2022-50675}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
  - efivarfs: force RO when remounting if SetVariable is not supported {CVE-2023-52463}
  - Fix page corruption caused by racy check in __free_pages {CVE-2023-52739}
  - mptcp: deal with large GSO size {CVE-2023-52778}
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new {CVE-2023-52887}
  - drm/i915/active: Fix misuse of non-idle barriers as fence trackers {CVE-2023-53087}
  - ext4: fix task hung in ext4_xattr_delete_inode {CVE-2023-53089}
  - ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent {CVE-2023-53070}
  - bnxt_en: Avoid order-5 memory allocation for TPA data {CVE-2023-53134}
  - tcp: tcp_make_synack() can be called from process context {CVE-2023-53121}
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode {CVE-2023-53114}
  - skbuff: Fix a race between coalescing and releasing SKBs {CVE-2023-53186}
  - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() {CVE-2023-53421}
  - arm64: mm: fix VA-range sanity check {CVE-2023-53989}
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() {CVE-2024-26633}
  - SUNRPC: double free xprt_ctxt while still in use {CVE-2023-54269}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed {CVE-2024-26976}
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly {CVE-2024-26922}
  - tracing/trigger: Fix to return error if failed to alloc snapshot {CVE-2024-26920}
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). {CVE-2024-36933}
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
  - scsi: qla2xxx: During vport delete send async logout explicitly {CVE-2024-42289}
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() {CVE-2022-49731}
  - ixgbevf: Fix resource leak in ixgbevf_init_module() {CVE-2022-49028}
  - mmc: core: Avoid bitfield RMW for claim/retune flags {CVE-2026-43484}
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835}
  - cpufreq: Init completion before kobject_init_and_add() {CVE-2022-50473}
  - USB: gadget: Fix use-after-free during usb config switch {CVE-2022-50704}
  - IB/mad: Don't call to function that might sleep while in atomic context {CVE-2022-50472}
  - null_blk: fix poll request timeout handling {CVE-2023-53531}
  - drm/i915/gvt: fix vgpu debugfs clean in remove {CVE-2023-53625}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning {CVE-2024-43880}
  - drm/drm_vma_manager: Add drm_vma_node_allow_once() {CVE-2023-53001}
  - drm/amd/display: fix mapping to non-allocated address {CVE-2023-53753}
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() {CVE-2023-54265}
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). {CVE-2023-54004}
  - netlink: terminate outstanding dump on socket close {CVE-2024-53140}
  - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN {CVE-2024-53135}
  - scsi: qla2xxx: Fix use after free on unload {CVE-2024-56623}
  - net: Fix icmp host relookup triggering ip_rt_bug {CVE-2024-56647}
  - spi: spi-imx: Add check for spi_imx_setupxfer() {CVE-2025-37801}
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop {CVE-2026-23300}
  - ethtool: check device is present when getting link settings {CVE-2024-46679}
  - nfsd: return -EINVAL when namelen is 0 {CVE-2024-47692}
  - x86/ioapic: Handle allocation failures gracefully {CVE-2024-49927}
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error {CVE-2024-49959}
  - secretmem: disable memfd_secret() if arch cannot set direct map {CVE-2024-50182}
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures {CVE-2024-53190}
  - iommu/arm-smmu: Defer probe of clients after smmu device bound {CVE-2024-56568}
  - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers {CVE-2025-21885}
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs {CVE-2025-37805}
  - page_pool: avoid infinite loop to schedule delayed worker {CVE-2025-37859}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
  - tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
  - ipv6: add NULL checks for idev in SRv6 paths {CVE-2026-23442}
  - sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
  - netfilter: xt_multiport: validate range encoding in checkentry {CVE-2026-31681}
  - net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
  - vxlan: validate ND option lengths in vxlan_na_create {CVE-2026-31738}
  - gfs2: fiemap page fault fix {CVE-2026-43262}
  - e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els8]
changelog:
  - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
  - ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
  - KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
  - Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
  - xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
  - sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
  - blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
  - gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
  - HID: betop: check shape of output reports {CVE-2023-53015}
  - mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
  - HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
  - drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
  - ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
  - RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
  - Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
  - scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
  - sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
  - ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
  - nbd: don't allow reconnect after disconnect {CVE-2025-21731}
  - openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
  - net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
  - ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
  - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
  - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
  - xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
  - virtgpu: don't reset on shutdown {CVE-2025-38064}
  - xen/netfront: fix crash when removing device {CVE-2022-48969}
  - mptcp: do not fallback when OoO is present {CVE-2024-50185}
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
  - xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
  - ext4: fix racy may inline data check in dio write {CVE-2023-52786}
  - drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
  - macsec: fix UAF bug for real_dev {CVE-2022-49390}
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
  - mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
  - driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
  - udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
  - ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
  - net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
  - udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
  - RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
  - dlm: fix possible lkb_resource null dereference {CVE-2024-47809}
  - ACPI: battery: Fix possible crash when unregistering a battery hook {CVE-2024-49955}
  - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params {CVE-2024-58012}
  - tpm: Change to kvalloc() in eventlog/acpi.c {CVE-2024-58005}
  - net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
  - usb: xhci: Fix NULL pointer dereference on certain command aborts {CVE-2024-57981}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() {CVE-2025-21861}
  - bpf: avoid holding freeze_mutex during mmap operation {CVE-2025-21853}
  - acct: perform last write from workqueue {CVE-2025-21846}
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() {CVE-2025-21959}
  - ipvlan: ensure network headers are in skb linear part {CVE-2025-21891}
  - wifi: iwlwifi: mvm: fix 6 GHz scan construction {CVE-2024-53055}
  - signal: restore the override_rlimit logic {CVE-2024-50271}
  - thermal: core: Reference count the zone in thermal_zone_get_by_id() {CVE-2024-50028}
  - block: fix potential invalid pointer dereference in blk_add_partition {CVE-2024-47705}
  - userfaultfd: fix checks for huge PMDs {CVE-2024-46787}
  - mptcp: pm: only mark 'subflow' endp as available {CVE-2024-45010}
  - mptcp: pm: re-using ID of unused flushed subflows {CVE-2024-45010}
  - eth: bnxt: fix truesize for mb-xdp-pass case {CVE-2025-21961}
  - driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
  - virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
  - cgroup: fix race between task migration and iteration {CVE-2026-43439}
  - bpf: Fix wrong reg type conversion in release_reference() {CVE-2022-49873}
  - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error {CVE-2025-21732}
  - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN {CVE-2026-23472}
  - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion {CVE-2026-23468}
  - net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
  - tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
  - RDMA/mlx5: Fix a WARN during dereg_mr for DM type {CVE-2025-21888}
  - list: fix a data-race around ep->rdllist {CVE-2022-49443}
  - can: isotp: sanitize CAN ID checks in isotp_bind() {CVE-2022-49269}
  - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
  - sched/rt: Fix race in push_rt_task {CVE-2025-38234}
  - NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
  - virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
  - block: fix resource leak in blk_register_queue() error path {CVE-2025-37980}
  - xsk: Fix race condition in AF_XDP generic RX path {CVE-2025-37920}
  - mm/vmscan: don't try to reclaim hwpoison folio {CVE-2025-37834}
  - nouveau: offload fence uevents work to workqueue {CVE-2024-26719}
  - bpf: Fix kmemleak warning for percpu hashmap {CVE-2025-37807}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h {CVE-2024-26906}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket {CVE-2024-42246}
  - quota: Fix potential NULL pointer dereference {CVE-2024-26878}
  - arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}
  - ALSA: Fix deadlocks with kctl removals at disconnection {CVE-2024-38600}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values {CVE-2024-42114}
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() {CVE-2024-41063}
  - fsnotify: clear PARENT_WATCHED flags lazily {CVE-2024-47660}
  - mm: use memalloc_nofs_save() in page_cache_ra_order() {CVE-2024-36882}
  - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled {CVE-2024-26987}
  - net: esp: fix bad handling of pages from page_pool {CVE-2024-26953}
  - virtio/vsock: Fix accept_queue memory leak {CVE-2024-53119}
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() {CVE-2024-50251}
  - fs/proc: fix softlockup in __read_vmcore (part 2) {CVE-2025-21694}
  - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability {CVE-2024-53051}
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. {CVE-2025-23143}
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090}
  - net: decrease cached dst counters in dst_release {CVE-2025-22057}
  - nfsd: put dl_stid if fail to queue dl_recall {CVE-2025-22025}
  - nfsd: make nfsd4_run_cb a bool return function {CVE-2025-22025}
  - usb: gadget: core: flush gadget workqueue after device removal {CVE-2025-21838}
  - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 {CVE-2025-21831}
  - media: uvcvideo: Fix crash during unbind if gpio unit is in use {CVE-2024-58079}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() {CVE-2023-52877}
  - ext4: filesystems without casefold feature cannot be mounted with siphash {CVE-2024-49968}
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow {CVE-2024-47739}
  - bpf, lsm: Add check for BPF LSM return value {CVE-2024-47703}
  - sched/smt: Fix unbalance sched_smt_present dec/inc {CVE-2024-44958}
  - xen-netfront: Fix NULL sring after live migration {CVE-2022-48969}
  - dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
  - udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
  - bpf: sync_linked_regs() must preserve subreg_def {CVE-2024-53125}
  - mptcp: handle consistently DSS corruption {CVE-2024-50185}
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' {CVE-2024-36478}
  - net: tunnels: annotate lockless accesses to dev->needed_headroom {CVE-2023-53109}
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled {CVE-2025-38039}
  - uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
  - mm: slub: avoid wake up kswapd in set_track_prepare {CVE-2025-39843}
  - mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
  - bpf: Reject narrower access to pointer ctx fields {CVE-2025-38591}
  - net: clear the dst when changing skb protocol {CVE-2025-38192}
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() {CVE-2025-23144}
  - RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
  - can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. {CVE-2025-22111}
  - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
  - loop: Avoid updating block size under exclusive owner {CVE-2025-38709}
  - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
  - net_sched: sch_sfq: reject invalid perturb period {CVE-2025-38193}
  - net: phy: mscc: Fix memory leak when using one step timestamping {CVE-2025-38148}
  - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
  - rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs {CVE-2025-38040}
  - usb: typec: ucsi: displayport: Fix deadlock {CVE-2025-37967}
  - ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
  - bpf: Scrub packet on bpf_redirect_peer {CVE-2025-37959}
  - tracing: Verify event formats that have "%*p.." {CVE-2025-37938}
  - iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961}
  - net/mlx5e: Harden uplink netdev access against device unbind {CVE-2025-39947}
  - dm-stripe: fix a possible integer overflow {CVE-2025-39940}
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer {CVE-2025-39937}
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
  - net/mlx5e: Fix crash on profile change rollback failure {CVE-2026-23000}
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
  - tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
  - rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
  - net: can: j1939: recover socket queue on CAN bus error during BAM transmission {CVE-2026-22997}
  - dm-verity: disable recursive forward error correction {CVE-2025-71161}
  - netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd {CVE-2025-71147}
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() {CVE-2026-23069}
  - net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
  - ice: Don't process extts if PTP is disabled {CVE-2024-42107}
  - drm/i915/dpt: Make DPT object unshrinkable {CVE-2024-40924}
  - drm/i915/dpt: Treat the DPT BO as a framebuffer {CVE-2024-40924}
  - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx {CVE-2024-53091}
  - pipe: wakeup wr_wait after setting max_usage {CVE-2023-52672}
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails {CVE-2023-53103}
  - HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check {CVE-2024-57993}
  - drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853}
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization {CVE-2024-42129}
  - drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
  - gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
  - drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
  - drm/amdgpu: Add basic validation for RAS header {CVE-2025-38426}
  - mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
  - bpf: bpf_sk_storage: Fix invalid wait context lockdep report {CVE-2023-53857}
  - nvme-core: fix memory leak in dhchap_secret_store {CVE-2023-53852}
  - virtio_net: Fix error unwinding of XDP initialization {CVE-2023-53499}
  - nvme-core: fix memory leak in dhchap_ctrl_secret {CVE-2023-53792}
  - ceph: fix race condition validating r_parent before applying state {CVE-2025-39927}
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors {CVE-2023-53438}
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() {CVE-2023-53332}
  - nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net {CVE-2023-54276}
  - blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init {CVE-2023-54271}
  - net/mlx5e: TC, Fix internal port memory leak {CVE-2023-53999}
  - tipc: do not update mtu if msg_max is too small in mtu negotiation {CVE-2023-53517}
  - tipc: add tipc_bearer_min_mtu to calculate min mtu {CVE-2023-53517}
  - tun: Fix memory leak for detached NAPI queue. {CVE-2023-53685}
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
  - start_kernel: Add __no_stack_protector function attribute {CVE-2023-53491}
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
  - sched/psi: use kernfs polling functions for PSI trigger polling {CVE-2023-54019}
  - cxl/pmem: Fix nvdimm registration races {CVE-2023-54323}
  - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock {CVE-2025-68223}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() {CVE-2026-23004}
  - wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227}
  - md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
  - net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095}
  - drm/ttm: Don't leak a resource on eviction error {CVE-2023-54254}
  - firmware: arm_sdei: Fix sleep from invalid context BUG {CVE-2023-54160}
  - iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter {CVE-2023-54057}
  - net: usb: asix: validate PHY address before use {CVE-2025-71094}
  - tty: fix deadlock caused by calling printk() under tty_port->lock {CVE-2022-49441}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE {CVE-2026-23401}
  - blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
  - x86/CPU: Fix FPDSS on Zen1 {CVE-2025-54505}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
  - gfs2: No more self recovery {CVE-2025-38659}
  - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() {CVE-2022-49891}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() {CVE-2022-49796}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() {CVE-2022-49797}
  - netlink: Bounds-check struct nlmsgerr creation {CVE-2022-49766}
  - bpf: Prevent bpf program recursion for raw tracepoint probes {CVE-2022-49764}
  - i2c: designware: use casting of u64 in clock multiplication to avoid overflow {CVE-2022-49749}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
  - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
  - netfilter: ctnetlink: use netlink policy range checks {CVE-2026-31495}
  - tracing: Fix potential deadlock in cpu hotplug with osnoise {CVE-2026-31480}
  - esp: fix skb leak with espintcp and async crypto {CVE-2026-31518}
  - xfs: factor out xfs_attr3_leaf_init {CVE-2026-43053}
  - xfs: factor out xfs_attr3_node_entry_remove {CVE-2026-43053}
  - ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
  - bridge: br_nd_send: validate ND option lengths {CVE-2026-31752}
  - rtnetlink: add missing netlink_ns_capable() check for peer netns {CVE-2026-31692}
  - crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
  - APEI/GHES: ensure that won't go past CPER allocated record {CVE-2026-43277}
  - ceph: supply snapshot context in ceph_zero_partial_object() {CVE-2026-43273}
  - team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() {CVE-2025-71297}
  - EFI/CPER: don't go past the ARM processor CPER record buffer {CVE-2026-43266}
  - net: bridge: switchdev: Skip MDB replays of deferred events on offload {CVE-2024-26837}
  - can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
  - ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
  - netem: fix return value if duplicate enqueue fails {CVE-2024-45016}
  - USB: serial: mos7840: fix crash on resume {CVE-2024-42244}
  - crypto: null - Use spin lock instead of mutex {CVE-2025-37808}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
  - bpf: Fix overrunning reservations in ringbuf {CVE-2024-41009}
  - bpf: Fix bpf_sk_select_reuseport() memory leak {CVE-2025-21683}
  - drm/i915: Fix request ref counting during error capture & debugfs dump {CVE-2023-52981}
  - netfilter: conntrack: fix wrong ct->timeout value {CVE-2023-53635}
  - drop_monitor: replace spin_lock by raw_spin_lock {CVE-2024-40980}
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too {CVE-2024-50058}
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. {CVE-2026-31551}
  - ipv6: Fix signed integer overflow in __ip6_append_data {CVE-2022-49728}
  - selinux: avoid dereference of garbage after mount failure {CVE-2024-35904}
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name {CVE-2024-49934}
  - tracing: Do not let histogram values have some modifiers {CVE-2023-53093}
  - ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770}
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. {CVE-2025-37884}
  - fbmon: prevent division by zero in fb_videomode_from_videomode() {CVE-2024-35922}
  - drm/amdgpu: Fix the null pointer dereference to ras_manager {CVE-2024-43908}
  - tracing: Ensure visibility when inserting an element into tracing_map {CVE-2024-26645}
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func {CVE-2024-47720}
  - phy: mdio: fix memory leak {CVE-2021-47416}
  - ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097}
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() {CVE-2024-50046}
  - packet: annotate data-races around ignore_outgoing {CVE-2024-26862}
  - md: fix resync softlockup when bitmap size is less than array size {CVE-2024-38598}
  - wireguard: receive: annotate data-race around receiving_counter.counter {CVE-2024-26861}
  - netfs: Only call folio_start_fscache() one time for each folio {CVE-2023-52582}
  - usb: xhci: tegra: fix sleep in atomic call {CVE-2023-53475}
  - ACPI: PAD: fix crash in exit_round_robin() {CVE-2024-49935}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() {CVE-2024-50256}
  - Bluetooth: ISO: Fix multiple init when debugfs is disabled {CVE-2024-50077}
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio {CVE-2025-21931}
  - RDMA/core: Silence oversized kvmalloc() warning {CVE-2025-37867}
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() {CVE-2024-26663}
  - net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release() {CVE-2022-48961}
  - eth: alx: take rtnl_lock on resume {CVE-2022-50498}
  - ata: libata-transport: fix error handling in ata_tlink_add() {CVE-2022-49824}
  - ata: libata-transport: fix error handling in ata_tport_add() {CVE-2022-49825}
  - netfilter: br_netfilter: fix panic with metadata_dst skb {CVE-2024-50045}
  - net: fix NULL pointer in skb_segment_list {CVE-2023-52991}
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}
  - scsi: qla2xxx: validate nvme_local_port correctly {CVE-2024-42286}
  - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale {CVE-2023-53291}
  - wifi: mac80211: Discard Beacon frames to non-broadcast address {CVE-2025-71127}
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() {CVE-2024-46755}
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes {CVE-2024-41089}
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING {CVE-2023-52845}
  - bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets {CVE-2023-52523}
  - Bluetooth: Fix not cleanup led when bt_init fails {CVE-2022-48971}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range {CVE-2024-26851}
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() {CVE-2024-53680}
  - ppp_async: limit MRU to 64K {CVE-2024-26675}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
  - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work {CVE-2024-26631}
  - xfrm: fix one more kernel-infoleak in algo dumping {CVE-2024-50110}
  - xdp: fix invalid wait context of page_pool_destroy() {CVE-2024-43834}
  - fs/netfs/fscache_cookie: add missing "n_accesses" check {CVE-2024-45000}
  - mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
  - usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
  - IB/core: Fix ib_cache_setup_one error flow cleanup {CVE-2024-47693}
  - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate {CVE-2021-4454}
  - vfs: fix race between evice_inodes() and find_inode()&iput() {CVE-2024-47679}
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts {CVE-2023-53245}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
  - cachefiles: fix memory leak in cachefiles_add_cache() {CVE-2024-26840}
  - ext4: fix access to uninitialised lock in fc replay path {CVE-2024-50014}
  - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices {CVE-2025-21649}
  - ftrace: Fix regression with module command in stack_trace_filter {CVE-2024-56569}
  - ipv6: sr: fix invalid unregister error path {CVE-2024-38612}
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
  - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els9]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
  - mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit().
  - net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
  - ipv4: start using dst_dev_rcu()
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
  - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075}
  - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
  - udp6: Fix race condition in udp6_sendmsg & connect
  - ipv6: use RCU in ip6_output() {CVE-2025-40158}
  - ipv6: use RCU in ip6_xmit() {CVE-2025-40135}
  - ipv6: start using dst_dev_rcu()
  - net: dst: introduce dst->dev_rcu
  - neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158}
  - net: Add locking to protect skb->dev access in ip_output
  - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers
  - ipv6: adopt dst_dev() helper
  - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
  - net: dst: add four helpers to annotate data-races around dst->dev
  - tcp: convert to dev_net_rcu()
  - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els10]
changelog:
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available {CVE-2026-64561}
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
  - thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
  - drm/gud: Fix UBSAN warning {CVE-2022-50628}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
  - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests {CVE-2023-54108}
  - fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044}
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280}
  - isofs: Fix out of bound access for corrupted isofs image {CVE-2021-47478}
  - pppoe: drop PFC frames {CVE-2026-53003}
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free {CVE-2026-46304}
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
  - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
  - irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions {CVE-2022-49716}
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
  - can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
  - cxl/mem: Fix shutdown order {CVE-2023-52849}
  - pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
  - usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242}
  - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350}
  - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088}
  - HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
  - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle {CVE-2023-53250}
  - usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288}
  - wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092}
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697}
  - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650}
  - HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520}
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522}
  - scsi: qla2xxx: Avoid fcport pointer dereference {CVE-2023-53603}
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178}
  - scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473}
  - HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111}
  - tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320}
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180}
  - usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432}
  - PCI: Fix reset_method_store() memory leak {CVE-2024-56745}
  - rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079}
  - net: stmmac: fix integer underflow in chain mode {CVE-2026-31649}
  - be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
  - thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147}
  - Input: uinput - fix circular locking dependency with ff-core {CVE-2026-31667}
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency {CVE-2023-52855}
  - nbd: defer config put in recv_work {CVE-2025-68372}
  - net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
  - serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
  - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() {CVE-2024-47734}
  - dm-thin: fix metadata refcount underflow {CVE-2026-46107}
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
  - usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
  - md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
  - wifi: rtw89: fix potential race condition between napi_init and napi_enable {CVE-2023-53452}
  - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl {CVE-2021-47634}
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
  - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used {CVE-2025-38113}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() {CVE-2025-40211}
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() {CVE-2026-45982}
  - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
  - ACPI: pfr_update: Fix the driver update version check {CVE-2025-39701}
  - spi: imx: fix use-after-free on unbind {CVE-2026-45996}
  - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
  - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access {CVE-2026-46094}
  - xdp: produce a warning when calculated tailroom is negative {CVE-2026-23343}
  - vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check {CVE-2023-53543}
  - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
  - topology: Keep the cpumask unchanged when printing cpumap {CVE-2024-57917}
  - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers {CVE-2026-43059}
  - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early {CVE-2025-39861}
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' {CVE-2025-38593}
  - mm/damon/sysfs: fix use-after-free in state_show() {CVE-2025-39877}
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation {CVE-2026-43133}
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334}
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
  - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239}
  - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file {CVE-2024-42138}
  - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233}
  - bpf: Fix stack-out-of-bounds write in devmap {CVE-2026-23359}
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() {CVE-2025-39776}
  - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry {CVE-2026-43114}
  - gve: Account for stopped queues when reading NIC stats {CVE-2024-42162}
  - gve: Fix stats report corruption on queue count change {CVE-2026-23262}
  - amba: use generic driver_override infrastructure
  - Drivers: hv: vmbus: use generic driver_override infrastructure
  - vdpa: use generic driver_override infrastructure {CVE-2026-53118}
  - PCI: use generic driver_override infrastructure {CVE-2026-53120}
  - spi: use generic driver_override infrastructure {CVE-2026-31487}
  - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
  - driver core: generalize driver_override in struct device {CVE-2026-31688}
  - arm64: topology: fix possible overflow in amu_fie_setup() {CVE-2022-48657}
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing {CVE-2025-68185}
  - NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
  - rxrpc: Fix key reference count leak from call->key {CVE-2026-31639}
  - rxrpc: Only put the call ref if one was acquired {CVE-2026-31638}
  - bpf: Set run context for rawtp test_run callback {CVE-2024-40908}
  - ethtool: Fix uninitialized number of lanes {CVE-2023-53798}
  - xsk: fix refcount underflow in error path {CVE-2023-53698}
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs {CVE-2026-23340}
  - net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504}
  - net: avoid race between device unregistration and ethnl ops {CVE-2025-21701}
  - net: sched: Disallow replacing of child qdisc from one parent to another {CVE-2025-21700}
  - libceph: Fix potential out-of-bounds access in osdmap_decode() {CVE-2026-52958}
  - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() {CVE-2026-46024}
  - libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined {CVE-2025-71224}
  - wifi: mac80211: prohibit deactivating all links {CVE-2024-58061}
  - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() {CVE-2025-21937}
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state {CVE-2026-31773}
  - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() {CVE-2025-21936}
  - Bluetooth: fix memory leak in error path of hci_alloc_dev() {CVE-2026-53252}
  - netfilter: nf_tables: unconditionally flush pending work before notifier {CVE-2024-42109}
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm {CVE-2025-39894}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case {CVE-2026-23456}
  - iavf: Fix out-of-bounds when setting channels on remove {CVE-2023-53659}
  - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339}
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els11]
changelog:
  - wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133}
  - wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133}
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957}
  - KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344}
  - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133}
  - crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231}
  - tls: handle data disappearing from under the TLS ULP {CVE-2025-38616}
  - Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140}
  - Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering)
  - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
  - net: add exit_batch_rtnl() method
  - rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
  - virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769}
  - ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233}
  - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
  - scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232}
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371}
  - net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670}
  - intel_th: fix device leak on output open() {CVE-2026-23091}
  - batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
  - rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642}
  - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
  - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}
  - mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434}
  - x86/efi: defer freeing of boot services memory {CVE-2026-23352}
  - KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
  - usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108}
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104}
  - drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}
  - amba: bus: fix refcount leak {CVE-2023-54230}
  - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194}
  - octeontx2-af: Add validation for lmac type {CVE-2023-54129}
  - rcu: dump vmalloc memory info safely {CVE-2023-54113}
  - wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071}
  - bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033}
  - ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866}
  - netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863}
  - md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848}
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824}
  - net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663}
  - bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650}
  - blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227}
  - usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501}
  - scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
  - Bluetooth: L2CAP: Fix responding with wrong PDU type
  - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els12]
changelog:
  - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
  - static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954}
  - static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002}
  - smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
  - scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296}
  - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336}
  - smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295}
  - sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261}
  - usbnet: Prevents free active kevent {CVE-2025-68312}
  - libceph: bound get_version reply decode to front len {CVE-2026-68433}
  - neigh: let neigh_xmit take skb ownership {CVE-2026-52981}
  - gve: prevent ethtool ops after shutdown {CVE-2025-38735}
  - vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
  - NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}
  - thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093}
  - quota: fix warning in dqgrab() {CVE-2023-54177}
  - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066}
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
  - xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093}
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497}
  - bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}
  - ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402}
  - binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239}
  - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929}
  - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102}
  - xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}
  - i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029}
  - bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086}
  - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
  - net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268}
  - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
  - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}
  - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096}
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723}
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192}
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838}
  - clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767}
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
  - drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704}
  - crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races {CVE-2026-23230}
  - net/smc: initialize close_work early to avoid warning {CVE-2024-56641}
  - netfilter: nft_ct: add seqadj extension for natted connections {CVE-2025-68206}
  - net/sched: sch_netem: fix out-of-bounds access in packet corruption {CVE-2026-31675}
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() {CVE-2026-31426}
  - bpf: Reject sleepable kprobe_multi programs at attach time {CVE-2026-43010}
  - ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area {CVE-2025-40153}
  - mptcp: pm: ADD_ADDR rtx: fix potential data-race {CVE-2026-46137}
  - Input: uinput - take event lock when submitting FF request "event"
  - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result {CVE-2024-35998}
  - drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
  - netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243}
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ {CVE-2026-64210}
  - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen {CVE-2026-23253}
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check {CVE-2025-38543}
  - tls: Purge async_hold in tls_decrypt_async_wait() {CVE-2026-23414}
  - tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c {CVE-2024-56725}
  - cpufreq: CPPC: Add u64 casts to avoid overflowing {CVE-2022-49750}
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions {CVE-2022-49715}
  - ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
  - spi: fix use-after-free on controller registration failure {CVE-2026-31389}
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw() {CVE-2025-22005}
  - bpf: Fix stackmap overflow check in __bpf_get_stackid() {CVE-2025-68378}
  - bpf: Fix RCU stall in bpf_fd_array_map_clear() {CVE-2026-53083}
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
  - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure {CVE-2026-23142}
  - Squashfs: reject negative file sizes in squashfs_read_inode() {CVE-2025-40200}
  - i40e: Fix preempt count leak in napi poll tracepoint {CVE-2026-23313}
  - i2c: core: fix adapter deregistration race {CVE-2026-64279}
  - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
  - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
  - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
  - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
  - Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els27]
changelog:
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
  - drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
  - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
  - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280}
  - ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
  - netfilter: nf_tables: do not compare internal table flags on updates {CVE-2024-27065}
  - init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
  - wireguard: netlink: check for dangling peer via is_dead instead of empty list {CVE-2024-26951}
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077}
  - exfat: fix double free in delayed_free {CVE-2025-38206}
  - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write {CVE-2023-54286}
  - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
  - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
  - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
  - software node: Correct a OOB check in {CVE-2025-38342}
  - nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
  - USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
  - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
  - cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
  - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
  - md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
  - md/raid10: fix overflow of md/safe_mode_delay
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
  - lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
  - net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
  - ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
  - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
  - RDMA/mlx5: Handle DCT QP logic separately from low level QP interface
  - net/mlx5e: Use correct encap attribute during invalidation {CVE-2023-54074}
  - net/mlx5: Nullify qp->dbg pointer post destruction
  - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
  - net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272}
  - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  - sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
  - netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els28]
changelog:
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
  - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
  - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
  - ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}
  - rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
  - ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
  - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
  - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
  - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
  - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
  - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
  - nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
  - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() {CVE-2023-54155}
  - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
  - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
  - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device {CVE-2023-54015}
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages {CVE-2023-53996}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
  - page_pool: fix inconsistency for page_pool_ring_[un]lock()
  - net: page_pool: use in_softirq() instead {CVE-2025-38129}
  - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
  - vsock: avoid to close connected socket after the timeout {CVE-2025-40248}
  - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
  - i40e: validate ring_len parameter against hardware-specific values
  - i40e: add validation for ring_len param {CVE-2025-39973}
  - i40e: increase max descriptors for XL710
  - i40e: remove read access to debugfs files {CVE-2025-39901}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
  - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
  - i2c: tegra: check msg length in SMBUS block read {CVE-2025-38425}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
  - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
  - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
  - can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow {CVE-2023-54102}
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
  - tcp: minor optimization in tcp_add_backlog() {CVE-2022-50865}
  - block, bfq: fix uaf for bfqq in bic_set_bfqq() {CVE-2023-52983}
  - block, bfq: replace 0/1 with false/true in bic apis
  - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq {CVE-2022-50329}
  - block, bfq: fix possible uaf for 'bfqq->bic' {CVE-2022-50488}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
  - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
  - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
  - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
  - net: atm: add lec_mutex {CVE-2025-38323}
  - Bluetooth: hci_sync: always check if connection is alive before deleting
  - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync {CVE-2023-53762}
  - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
  - net_sched: remove qdisc_tree_flush_backlog()
  - net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
  - net_sched: tbf: fix a race in tbf_change()
  - net_sched: prio: fix a race in prio_tune() {CVE-2025-38083}
  - net_sched: red: fix a race in __red_change() {CVE-2025-38108}
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
  - smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
  - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request {CVE-2025-38013}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
  - mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
  - wifi: ath10k: Delay the unmapping of the buffer {CVE-2022-50700}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
  - ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
  - drm/amd/display: fix FCLK pstate change underflow {CVE-2023-53780}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els29]
changelog:
  - fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
  - qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
  - drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
  - pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
  - netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
  - fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
  - svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
  - bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
  - scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
  - memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
  - ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
  - net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
  - usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
  - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
  - rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
  - block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
  - wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
  - wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
  - wifi: mac80211: check for station first in client probe {CVE-2023-53588}
  - bonding: do not assume skb mac_header is set {CVE-2023-53601}
  - drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
  - wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
  - net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
  - media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
  - md/raid10: fix memleak of md thread {CVE-2023-54294}
  - usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
  - scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
  - HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
  - driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
  - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
  - bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
  - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
  - mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
  - bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
  - net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
  - net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
  - net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
  - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
  - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
  - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
  - HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
  - xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835}
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535}
  - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
  - xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
  - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
  - drm/edid: fix info leak when failing to get panel id {CVE-2023-53085}
  - xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
  - vdpa: Add features attr to vdpa_nl_policy for nlattr length check {CVE-2023-53652}
  - virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
  - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy {CVE-2025-40251}
  - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
  - HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
  - udf: Do not bother merging very long extents {CVE-2023-53506}
  - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
  - ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
  - tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
  - gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  - iavf: Fix use-after-free in free_netdev {CVE-2023-53556}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els30]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
  - crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
  - crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
  - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
  - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
  - ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
  - intel_th: msu: Fix vmalloced buffers {CVE-2022-50142}
  - vt: Clear selection before changing the font {CVE-2022-49948}
  - ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
  - usbnet: Run unregister_netdev() before unbind_all() {CVE-2022-50220}
  - ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
  - bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
  - module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444}
  - ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
  - tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
  - xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
  - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
  - net: hns3: add VLAN id validation before using {CVE-2025-71112}
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
  - i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
  - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add {CVE-2022-50384}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() {CVE-2025-37940}
  - net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155}
  - ext4: set goal start correctly in ext4_mb_normalize_request {CVE-2023-54021}
  - netfilter: ipset: fix region locking in hash types {CVE-2025-37997}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() {CVE-2025-37998}
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() {CVE-2025-37990}
  - nfs: handle failure of nfs_get_lock_context in unlock path {CVE-2025-38023}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37767}
  - netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
  - tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167}
  - ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
  - scsi: qla2xxx: Pointer may be dereferenced {CVE-2023-53150}
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() {CVE-2025-38061}
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes {CVE-2025-38066}
  - libnvdimm/labels: Fix divide error in nd_label_data_init() {CVE-2025-38072}
  - wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() {CVE-2023-53251}
  - tracing: Free error logs of tracing instances {CVE-2023-53375}
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes {CVE-2025-38466}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO {CVE-2025-38122}
  - dma-buf: insert memory barrier before updating num_fences {CVE-2025-38095}
  - x86/sgx: Prevent attempts to reclaim poisoned pages {CVE-2025-38334}
  - ext4: inline: fix len overflow in ext4_prepare_inline_data {CVE-2025-38222}
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38214}
  - sctp: initialize more fields in sctp_v6_from_sk() {CVE-2025-39812}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
  - usb: net: sierra: check for no status endpoint {CVE-2025-38474}
  - vxlan: Annotate FDB data races {CVE-2025-38037}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling {CVE-2025-38115}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert {CVE-2025-38387}
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() {CVE-2025-38312}
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() {CVE-2022-50829}
  - wifi: mt76: disable napi on driver removal {CVE-2025-38009}
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump {CVE-2025-39813}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
  - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
  - RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133}
  - scsi: qla4xxx: Prevent a potential error pointer dereference {CVE-2025-39676}
  - ppp: fix race conditions in ppp_fill_forward_path {CVE-2025-39673}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990}
  - thunderbolt: Do not double dequeue a configuration request {CVE-2025-38174}
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
  - ACPICA: fix acpi operand cache leak in dswstate.c {CVE-2025-38345}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH {CVE-2025-38063}
  - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs {CVE-2023-53391}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference {CVE-2025-38231}
  - udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs {CVE-2025-38285}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
  - nvmet-tcp: don't restore null sk_state_change {CVE-2025-38035}
  - wifi: iwlwifi: mvm: fix double free on tx path. {CVE-2022-50248}
  - ACPICA: fix acpi parse and parseext cache leaks {CVE-2025-38344}
  - bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
  - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
  - cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() {CVE-2023-53479}
  - fbcon: Fix OOB access in font allocation
  - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
  - rename(): fix the locking of subdirectories
  - scsi: qedi: Fix use after free bug in qedi_remove() {CVE-2023-54100}
  - ixgbe: Fix panic during XDP_TX with > 64 CPUs {CVE-2023-54090}
  - bpf: Do not let BPF test infra emit invalid GSO types to stack {CVE-2025-68725}
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() {CVE-2023-54014}
  - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() {CVE-2022-50699}
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() {CVE-2025-39808}
  - PCI: Fix dropping valid root bus resources with .end = zero {CVE-2023-53814}
  - KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state {CVE-2023-53208}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini {CVE-2023-53193}
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() {CVE-2025-39795}
  - libceph: return the handler error from mon_handle_auth_done() {CVE-2026-22992}
  - Bluetooth: Fix hci_suspend_sync crash {CVE-2023-53520}
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() {CVE-2025-39782}
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists {CVE-2025-38601}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
  - libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
  - soundwire: fix enumeration completion {CVE-2023-54096}
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path {CVE-2022-50845}
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages {CVE-2023-53709}
  - netlink: fix potential deadlock in netlink_set_err() {CVE-2023-53731}
  - xhci: dbc: Fix memory leak in xhci_alloc_dbc() {CVE-2022-50809}
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline {CVE-2022-50286}
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
  - driver core: location: Free struct acpi_pld_info *pld before return false {CVE-2023-53211}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() {CVE-2025-39845}
  - dma-buf/dma-resv: Stop leaking on krealloc() failure {CVE-2023-53181}
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct {CVE-2025-38514}
  - xfrm: Zero padding when dumping algos and encap {CVE-2023-53684}
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer {CVE-2023-53648}
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF {CVE-2023-53747}
  - ice: fix wrong fallback logic for FDIR {CVE-2023-54040}
  - cifs: Fix xid leak in cifs_create() {CVE-2022-50351}
  - drm/amd/display: populate subvp cmd info only for the top pipe {CVE-2023-53806}
  - netfilter: ctnetlink: fix refcount leak on table dump {CVE-2025-38721}
  - sfc: fix crash when reading stats while NIC is resetting {CVE-2023-54156}
  - Bluetooth: Fix race condition in hidp_session_thread {CVE-2023-54120}
  - bpf: Reject %p% format string in bprintf-like helpers {CVE-2025-38528}
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy {CVE-2023-54048}
  - RDMA/siw: Fix immediate work request flush to completion queue {CVE-2022-50736}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() {CVE-2025-38617}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr {CVE-2025-38701}
  - IB/hfi1: Fix possible panic during hotplug remove {CVE-2023-53488}
  - cgroup: split cgroup_destroy_wq into 3 workqueues {CVE-2025-39953}
  - NFS: Fix the setting of capabilities when automounting a new filesystem {CVE-2025-39798}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX {CVE-2025-39756}
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() {CVE-2025-39713}
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
  - wifi: mac80211: reject TDLS operations when station is not associated {CVE-2025-38644}
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() {CVE-2023-53271}
  - RDMA/bnxt_re: wraparound mbox producer index {CVE-2023-53201}
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies {CVE-2025-38100}
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() {CVE-2025-38706}
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated {CVE-2025-38700}
  - ALSA: hda: Fix Oops by 9.1 surround channel names {CVE-2023-53400}
  - mm: move page table sync declarations to linux/pgtable.h {CVE-2025-39844}
  - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access {CVE-2023-53419}
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails {CVE-2023-53199}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras {CVE-2025-38540}
  - scsi: ses: Don't attach if enclosure has no components {CVE-2023-53431}
  - ipv6/addrconf: fix a potential refcount underflow for idev {CVE-2023-53189}
  - wifi: ath11k: Fix SKB corruption in REO destination ring {CVE-2023-53315}
  - bpf: fix ktls panic with sockmap {CVE-2025-38166}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
  - net: openvswitch: fix race on port output {CVE-2023-53188}
  - net_sched: Flush gso_skb list too during ->change() {CVE-2025-37992}
  - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
  - af_unix: Fix data-race around unix_tot_inflight. {CVE-2023-54006}
  - watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234}
  - usb: idmouse: fix an uninit-value in idmouse_open {CVE-2022-50733}
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN {CVE-2023-53369}
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() {CVE-2022-50347}
  - Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
  - x86/apic: Don't disable x2APIC if locked {CVE-2022-50720}
  - serial: 8250: Reinit port->pm on port specific driver unbind {CVE-2023-53176}
  - devlink: hold region lock when flushing snapshots {CVE-2022-50712}
  - net: qrtr: Fix a refcount bug in qrtr_recvmsg() {CVE-2023-53445}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084}
  - PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
  - vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check {CVE-2023-54031}
  - atm: clip: prevent NULL deref in clip_push() {CVE-2025-38251}
  - ceph: fix potential use-after-free bug when trimming caps {CVE-2023-53867}
  - ACPI: video: check for error while searching for backlight device parent {CVE-2023-52693}
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL {CVE-2023-53246}
  - x86/xen: Fix memory leak in xen_init_lock_cpu() {CVE-2022-50761}
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping {CVE-2025-38126}
  - platform/x86: dell_rbu: Fix list usage {CVE-2025-38197}
  - x86/kexec: Fix double-free of elf header buffer {CVE-2023-54146}
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
  - KVM: Destroy target device if coalesced MMIO unregistration fails {CVE-2023-54024}
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table {CVE-2025-38319}
  - rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() {CVE-2022-50771}
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init {CVE-2023-53309}
  - net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301}
  - bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
  - bpf: Add cookie object to bpf maps {CVE-2025-38502}
  - misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks {CVE-2025-38412}
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN {CVE-2025-38048}
  - tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop {CVE-2025-37985}
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
  - wifi: ath11k: fix node corruption in ar->arvifs list {CVE-2025-38293}
  - x86/mm: Check return value from memblock_phys_alloc_range() {CVE-2025-38071}
  - net: Fix TOCTOU issue in sk_is_readable() {CVE-2025-38112}
  - scsi: mpi3mr: Fix an issue found by KASAN {CVE-2023-54011}
  - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper
  - scsi: qla2xxx: Array index may go out of bound {CVE-2023-54179}
  - net/mlx5e: fix memory leak in mlx5e_ptp_open {CVE-2023-54169}
  - igc: Fix Kernel Panic during ndo_tx_timeout callback {CVE-2023-54166}
  - Bluetooth: L2CAP: Fix potential user-after-free {CVE-2023-54214}
  - RDMA/restrack: Release MR restrack when delete {CVE-2022-50822}
  - RDMA/irdma: Fix memory leak of PBLE objects {CVE-2023-54055}
  - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup {CVE-2023-54275}
  - mptcp: stricter state check in mptcp_worker {CVE-2023-54176}
  - nfsd: provide locking for v4_end_grace {CVE-2026-22980}
  - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
  - net: atlantic: add check for MAX_SKB_FRAGS {CVE-2025-68301}
  - net: atlantic: reduce scope of is_rsc_complete
  - atlantic: Fix buff_ring OOB in aq_ring_rx_clean
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies {CVE-2025-40096}
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe {CVE-2022-50777}
  - wifi: rt2x00: Fix memory leak when handling surveys {CVE-2023-54131}
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() {CVE-2022-50740}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure {CVE-2026-23144}
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() {CVE-2022-50423}
  - wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133}
  - bpf: Move bpf map owner out of common struct {CVE-2025-38502}
  - fs: Lock moved directories
  - fs: Establish locking order for unrelated directories
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
  - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
  - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
  - ppp: fix memory leak in pad_compress_skb {CVE-2025-39847}
  - migrate: correct lock ordering for hugetlb file folios {CVE-2026-23097}
  - keys: Fix linking a duplicate key to a keyring's assoc_array {CVE-2023-54170}
  - scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
  - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() {CVE-2023-53320}
  - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range {CVE-2023-54229}
  - wifi: iwlwifi: pcie: fix possible NULL pointer dereference {CVE-2023-54053}
  - dm flakey: don't corrupt the zero page {CVE-2023-54317}
  - md/raid10: fix memleak for 'conf->bio_split' {CVE-2023-54123}
  - crypto: qat - fix out-of-bounds read {CVE-2023-54325}
  - drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP {CVE-2023-54263}
  - ipmi:ssif: Fix a memory leak when scanning for an adapter {CVE-2023-54064}
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" {CVE-2023-54197}
  - netfilter: nf_tables: always release netdev hooks from notifier {CVE-2023-54200}
  - wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO {CVE-2023-54029}
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe` {CVE-2023-53719}
  - soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow {CVE-2023-54259}
  - vfio/type1: fix cap_migration information leak {CVE-2023-54137}
  - drm/client: Fix memory leak in drm_client_target_cloned {CVE-2023-54091}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() {CVE-2025-39742}
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko {CVE-2025-38581}
  - iwlwifi: Add missing check for alloc_ordered_workqueue {CVE-2025-38602}
  - net: bridge: fix soft lockup in br_multicast_query_expired() {CVE-2025-39773}
  - net: drop UFO packets in udp_rcv_segment() {CVE-2025-38622}
  - iommu: Fix error unwind in iommu_group_alloc() {CVE-2023-53482}
  - qed: allow sleep in qed_mcp_trace_dump() {CVE-2023-53509}
  - cifs: Fix xid leak in cifs_flock() {CVE-2022-50460}
  - platform/x86: dell-sysman: Fix reference leak {CVE-2023-53631}
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure {CVE-2025-38695}
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls {CVE-2025-38608}
  - bpf: prevent decl_tag from being referenced in func_proto {CVE-2022-50862}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock {CVE-2025-39736}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() {CVE-2025-39737}
  - drm/amd/display: Fix potential null dereference {CVE-2023-53498}
  - x86/MCE/AMD: Use an u64 for bank_map {CVE-2023-53474}
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els31]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
  - x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
  - ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
  - skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
  - scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
  - HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
  - rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
  - drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
  - drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
  - tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
  - HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
  - thermal: int340x: Add NULL check for adev {CVE-2025-23136}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
  - wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
  - mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
  - EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
  - inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
  - net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
  - block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
  - tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
  - ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
  - ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
  - drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
  - dma: fix call order in dmam_free_coherent {CVE-2024-43856}
  - scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
  - ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
  - netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
  - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
  - Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
  - netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
  - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
  - EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
  - HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
  - filemap: Fix bounds checking in filemap_read() {CVE-2024-50272}
  - efi: fix potential NULL deref in efi_mem_reserve_persistent {CVE-2023-52976}
  - perf/x86/amd: fix potential integer overflow on shift of a int {CVE-2022-49748}
  - ext4: fix infinite loop when replaying fast_commit {CVE-2024-43828}
  - kthread: unpark only parked kthread {CVE-2024-50019}
  - xhci: tegra: fix checked USB2 port number {CVE-2024-50075}
  - Bluetooth: Call iso_exit() on module unload {CVE-2024-50078}
  - scsi: target: core: Fix null-ptr-deref in target_alloc_device() {CVE-2024-50153}
  - drm/radeon: Fix encoder->possible_clones {CVE-2024-50201}
  - squashfs: harden sanity check in squashfs_read_xattr_id_table {CVE-2023-52979}
  - xsk: fix an integer overflow in xp_create_and_assign_umem() {CVE-2025-21997}
  - can: j1939: j1939_session_new(): fix skb reference counting {CVE-2024-56645}
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue {CVE-2023-52743}
  - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection {CVE-2024-56533}
  - sched/core: Prevent rescheduling when interrupts are disabled {CVE-2024-58090}
  - HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections {CVE-2024-57986}
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow {CVE-2025-22086}
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs {CVE-2025-22045}
  - Bluetooth: btrtl: Prevent potential NULL dereference {CVE-2025-37792}
  - tracing/histograms: Fix memory leak problem {CVE-2022-49648}
  - net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
  - ext4: fix another off-by-one fsmap error on 1k block filesystems {CVE-2023-53143}
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open {CVE-2024-46791}
  - crypto: ecdh - explicitly zeroize private_key {CVE-2024-42098}
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
  - geneve: do not assume mac header is set in geneve_xmit_skb() {CVE-2024-56636}
  - tracing/timerlat: Fix a race during cpuhp processing {CVE-2024-49866}
  - x86/mtrr: Check if fixed MTRRs exist before saving them {CVE-2024-44948}
  - genirq/irq_sim: Initialize work context pointers properly {CVE-2025-38408}
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() {CVE-2025-38664}
  - mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
  - objtool: Fix SEGFAULT {CVE-2022-50879}
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() {CVE-2022-49307}
  - can: af_can: fix NULL pointer dereference in can_rx_register() {CVE-2022-49863}
  - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() {CVE-2022-49869}
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map {CVE-2022-49832}
  - tty: vt: initialize unicode screen buffer {CVE-2022-50222}
  - mfd: max77620: Fix refcount leak in max77620_initialise_fps {CVE-2022-50108}
  - pnode: terminate at peers of source {CVE-2022-50280}
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref {CVE-2022-50380}
  - chardev: fix error handling in cdev_device_add() {CVE-2022-50282}
  - net: hinic: fix the issue of CMDQ memory leaks {CVE-2022-50387}
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
  - tracing: Do not register unsupported perf events {CVE-2025-71125}
  - ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
  - can: j1939: make j1939_session_activate() fail if device is no longer registered {CVE-2025-71182}
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n {CVE-2026-23439}
  - xfrm: clear trailing padding in build_polexpire() {CVE-2026-31664}
  - wifi: rt2x00usb: fix devres lifetime {CVE-2026-31672}
  - mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
  - wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change {CVE-2024-50044}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes {CVE-2024-41095}
  - smb: client: fix deadlock in smb2_find_smb_tcon() {CVE-2024-39468}
  - drm/amdgpu: Fixed bug on error when unloading amdgpu {CVE-2023-52912}
  - usb: typec: ucsi: Fix null pointer dereference in trace {CVE-2024-46719}
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4 {CVE-2024-46819}
  - netfilter: flowtable: initialise extack before use {CVE-2024-45018}
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() {CVE-2024-47668}
  - drm/amd/display: Check null pointer before dereferencing se {CVE-2024-50049}
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption {CVE-2024-49858}
  - drm/amd/pm: ensure the fw_info is not null before using it {CVE-2024-49890}
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped {CVE-2024-47673}
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() {CVE-2024-49962}
  - drm/amd/display: Check stream before comparing them {CVE-2024-49896}
  - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() {CVE-2024-56593}
  - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() {CVE-2025-21689}
  - sctp: properly validate chunk size in sctp_sf_ootb() {CVE-2024-50299}
  - USB: usbtmc: prevent kernel-usb-infoleak {CVE-2024-47671}
  - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX {CVE-2024-58017}
  - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() {CVE-2025-21848}
  - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
  - linux/dim: Fix divide by 0 in RDMA DIM {CVE-2022-49670}
  - scsi: st: Fix array overflow in st_setup() {CVE-2025-37857}
  - usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() {CVE-2022-50825}
  - samples/bpf: Fix buffer overflow in tcp_basertt {CVE-2023-54312}
  - debugobjects: Don't wake up kswapd from fill_pool() {CVE-2023-54268}
  - regmap-irq: Fix out-of-bounds access when allocating config buffers {CVE-2023-53768}
  - RDMA/core: Fix GID entry ref leak when create_ah fails {CVE-2023-54003}
  - drm: Don't unref the same fb many times by mistake due to deadlock handling {CVE-2023-52486}
  - pstore/ram: Fix crash when setting number of cpus to an odd number {CVE-2023-52619}
  - net: usb: qmi_wwan: fix memory leak for not ip packets {CVE-2024-43861}
  - HID: i2c-hid-of: fix NULL-deref on failed power up {CVE-2024-26717}
  - netfilter: nf_tables: set dormant flag on hook register failure {CVE-2024-26835}
  - md: fix kmemleak of rdev->serial {CVE-2024-26900}
  - spi: fix null pointer dereference within spi_sync {CVE-2024-36930}
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() {CVE-2024-56748}
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() {CVE-2024-56747}
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport {CVE-2024-56688}
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag {CVE-2025-21699}
  - sock_map: Add a cond_resched() in sock_hash_free() {CVE-2024-47710}
  - net: stmmac: Fix zero-division error when disabling tc cbs {CVE-2024-49977}
  - net/mlx5: Fix error path in multi-packet WQE transmit {CVE-2024-50001}
  - HID: core: remove unnecessary WARN_ON() in implement() {CVE-2024-39509}
  - tipc: fix memory leak in tipc_link_xmit {CVE-2025-37757}
  - ima: Fix potential memory leak in ima_init_crypto() {CVE-2022-49627}
  - net: tun: unlink NAPI from device on destruction {CVE-2022-49672}
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() {CVE-2022-50505}
  - rxrpc: Fix bug due to prealloc collision {CVE-2025-38544}
  - ext4: zero i_disksize when initializing the bootloader inode {CVE-2023-53101}
  - scsi: hisi_sas: Add cond_resched() for no forced preemption model {CVE-2024-56589}
  - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path {CVE-2025-37788}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini {CVE-2023-53237}
  - samples/bpf: Fix fout leak in hbm's run_bpf_prog {CVE-2023-53290}
  - regulator: core: fix NULL dereference on unbind due to stale coupling data {CVE-2025-38668}
  - PM / devfreq: Fix leak in devfreq_dev_release() {CVE-2023-53518}
  - coresight: trbe: remove cpuhp instance node before remove cpuhp state {CVE-2022-50319}
  - net: phy: fix null-ptr-deref while probe() failed {CVE-2022-49021}
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() {CVE-2022-49002}
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() {CVE-2022-48972}
  - watch_queue: Free the page array when watch_queue is dismantled {CVE-2022-49148}
  - samples/landlock: Fix path_list memory leak {CVE-2021-47654}
  - net: tun: Fix memory leaks of napi_get_frags {CVE-2022-49871}
  - ftrace: Fix null pointer dereference in ftrace_add_mod() {CVE-2022-49802}
  - netdevsim: Fix memory leak of nsim_dev->fa_cookie {CVE-2022-49803}
  - tracing: Fix memory leak in tracing_read_pipe() {CVE-2022-49801}
  - mtd: core: fix possible resource leak in init_mtd() {CVE-2022-50304}
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() {CVE-2022-50321}
  - xfrm_user: fix info leak in build_report() {CVE-2026-31671}
  - regulator: core: fix resource leak in regulator_register() {CVE-2022-50724}
  - x86/tdx: Fix data leak in mmio_read() {CVE-2024-46794}
  - x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n {CVE-2021-47430}
  - ceph: remove the incorrect Fw reference check when dirtying pages {CVE-2024-50179}
  - nfs: Fix KMSAN warning in decode_getfattr_attrs() {CVE-2024-53066}
  - blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
  - cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
  - cifs: Fix xid leak in cifs_ses_add_channel() {CVE-2022-50856}
  - phy: tegra: xusb: Clear the driver reference in usb-phy dev {CVE-2023-54083}
  - drm/ttm: Don't leak a resource on swapout move error {CVE-2023-53844}
  - team: Move team device type change at the end of team_port_add {CVE-2025-68340}
  - udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock {CVE-2026-31592}
  - HID: core: clamp report_size in s32ton() to avoid undefined shift {CVE-2026-31624}
  - af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
  - nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
  - module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
  - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els32]
changelog:
  - net: skbuff: propagate shared-frag marker through pskb_copy()
  - HID: ignore non-functional sensor in HP 5MP Camera {CVE-2025-21992}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size {CVE-2024-50258}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() {CVE-2024-53042}
  - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
  - serial: imx: Add missing .thaw_noirq hook {CVE-2022-49841}
  - module: ensure that kobject_put() is safe for module type kobjects {CVE-2025-37995}
  - udf: Fix uninitialized array access for some pathnames {CVE-2023-53165}
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer {CVE-2023-53182}
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
  - icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
  - net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
  - ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389}
  - wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
  - HID: asus: avoid memory leak in asus_report_fixup() {CVE-2026-31524}
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL {CVE-2022-49321}
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() {CVE-2022-49567}
  - x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails {CVE-2022-49549}
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). {CVE-2022-49344}
  - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536}
  - net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() {CVE-2023-53578}
  - wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
  - mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
  - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
  - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}
  - Squashfs: check metadata block offset is within range {CVE-2026-23388}
  - apparmor: Fix double free of ns_name in aa_replace_profiles() {CVE-2026-23408}
  - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
  - i2c: piix4: Fix a memory leak in the EFCH MMIO support {CVE-2022-49653}


