# changelog

author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.7.1.el8_10]
changelog:
  - net: qcom/emac: fix UAF in emac_remove (Ken Cox) [RHEL-37834] {CVE-2021-47311}
  - perf/core: Bail out early if the request AUX area is out of bound (Michael Petlan) [RHEL-38268] {CVE-2023-52835}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET (Herbert Xu) [RHEL-38171] {CVE-2023-52813}
  - drm/amdgpu: fix use-after-free bug (Jocelyn Falempe) [RHEL-31240] {CVE-2024-26656}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash (Ivan Vecera) [RHEL-37008] {CVE-2024-35854}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update (Ivan Vecera) [RHEL-37004] {CVE-2024-35855}
  - mlxsw: spectrum_acl_tcam: Fix memory leak during rehash (Ivan Vecera) [RHEL-37012] {CVE-2024-35853}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work (Ivan Vecera) [RHEL-37016] {CVE-2024-35852}
  - mlxsw: spectrum_acl_tcam: Fix warning during rehash (Ivan Vecera) [RHEL-37480] {CVE-2024-36007}
  - can: peak_pci: peak_pci_remove(): fix UAF (Jose Ignacio Tornos Martinez) [RHEL-38419] {CVE-2021-47456}
  - usbnet: fix error return code in usbnet_probe() (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - usbnet: sanity check for maxpacket (Jose Ignacio Tornos Martinez) [RHEL-38440] {CVE-2021-47495}
  - net/mlx5e: fix a double-free in arfs_create_groups (Kamal Heib) [RHEL-36920] {CVE-2024-35835}
  - can: dev: can_put_echo_skb(): don't crash kernel if can_priv::echo_skb is accessed out of bounds (Jose Ignacio Tornos Martinez) [RHEL-38220] {CVE-2023-52878}
  - net: cdc_eem: fix tx fixup skb leak (Jose Ignacio Tornos Martinez) [RHEL-38080] {CVE-2021-47236}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path (Jose Ignacio Tornos Martinez) [RHEL-38113] {CVE-2023-52703}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() (Desnes Nunes) [RHEL-38248] {CVE-2023-52877}
  - usb: config: fix iteration issue in 'usb_get_bos_descriptor()' (Desnes Nunes) [RHEL-38240] {CVE-2023-52781}
  - gro: fix ownership transfer (Xin Long) [RHEL-37226] {CVE-2024-35890}
  - tipc: fix kernel warning when sending SYN message (Xin Long) [RHEL-38109] {CVE-2023-52700}
  - erspan: make sure erspan_base_hdr is present in skb->head (Xin Long) [RHEL-37230] {CVE-2024-35888}
  - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Bryan Gurney) [RHEL-17366]
  - scsi: mpi3mr: Sanitise num_phys (Bryan Gurney) [RHEL-17366]
  - netfilter: nf_tables: use timestamp to check for set element timeout (Phil Sutter) [RHEL-38023] {CVE-2024-27397}
  - net/ipv6: SKB symmetric hash should incorporate transport ports (Sabrina Dubroca) [RHEL-32061]
  - crypto: s390/aes - Fix buffer overread in CTR mode (Herbert Xu) [RHEL-37089] {CVE-2023-52669}
  - net: Save and restore msg_namelen in sock_sendmsg (Jamie Bainbridge) [RHEL-35893]
  - net: prevent address rewrite in kernel_bind() (Jamie Bainbridge) [RHEL-35893]
  - net: prevent rewrite of msg_name in sock_sendmsg() (Jamie Bainbridge) [RHEL-35893]
  - net: replace calls to sock->ops->connect() with kernel_connect() (Jamie Bainbridge) [RHEL-35893]
  - net: Avoid address overwrite in kernel_connect (Jamie Bainbridge) [RHEL-35893]
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination (Jose Ignacio Tornos Martinez) [RHEL-37026] {CVE-2024-35845}
  - wifi: mac80211: fix potential sta-link leak (Jose Ignacio Tornos Martinez) [RHEL-36916] {CVE-2024-35838}
  - wifi: nl80211: reject iftype change with mesh ID change (Jose Ignacio Tornos Martinez) [RHEL-36884] {CVE-2024-27410}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes (Jose Ignacio Tornos Martinez) [RHEL-36807] {CVE-2024-35789}
  - Bluetooth: Avoid potential use-after-free in hci_error_reset (David Marlin) [RHEL-31826] {CVE-2024-26801}
  - tls: disable async encrypt/decrypt (Sabrina Dubroca) [RHEL-26362 RHEL-26409 RHEL-26420] {CVE-2024-26584 CVE-2024-26583 CVE-2024-26585}
  - Squashfs: check the inode number is not the invalid value of zero (Phillip Lougher) [RHEL-35096] {CVE-2024-26982}
  - ipc/mqueue, msg, sem: avoid relying on a stack reference past its expiry (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/msg.c: update and document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/sem.c: document and update memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: update/document memory barriers (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - ipc/mqueue.c: remove duplicated code (Rafael Aquini) [RHEL-27782] {CVE-2021-47069}
  - net/mlx5e: Fix operation precedence bug in port timestamping napi_poll context (Kamal Heib) [RHEL-30582] {CVE-2023-52626}
  - Revert "ACPI: bus: Rework system-level device notification handling" (Prarit Bhargava) [RHEL-21486]
  - hwrng: core - Fix page fault dead lock on mmap-ed hwrng (Prarit Bhargava) [RHEL-29485] {CVE-2023-52615}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.17.1.el8_10]
changelog:
  - kyber: fix out of bounds access when preempted (Ming Lei) [RHEL-27258] {CVE-2021-46984}
  - vfs: don't mod negative dentry count when on shrinker list (Brian Foster) [RHEL-35874]
  - fs/dcache: Re-use value stored to dentry->d_flags instead of re-reading (Brian Foster) [RHEL-35874]
  - fbmem: Do not delete the mode that is still in use (CKI Backport Bot) [RHEL-37796] {CVE-2021-47338}
  - netpoll: Fix race condition in netpoll_owner_active (CKI Backport Bot) [RHEL-49361] {CVE-2024-41005}
  - firmware: arm_scpi: Fix string overflow in SCPI genpd driver (Mark Salter) [RHEL-43702] {CVE-2021-47609}
  - ipv6: prevent possible NULL dereference in rt6_probe() (Guillaume Nault) [RHEL-48149] {CVE-2024-40960}
  - HID: i2c-hid-of: fix NULL-deref on failed power up (CKI Backport Bot) [RHEL-31598] {CVE-2024-26717}
  - cpufreq: amd-pstate: fix memory leak on CPU EPP exit (CKI Backport Bot) [RHEL-48489] {CVE-2024-40997}
  - x86/mm/pat: fix VM_PAT handling in COW mappings (Chris von Recklinghausen) [RHEL-37258] {CVE-2024-35877}
  - PCI/PM: Drain runtime-idle callbacks before driver removal (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - PCI: Drop pci_device_remove() test of pci_dev->driver (Myron Stowe) [RHEL-42937] {CVE-2024-35809}
  - drm/radeon: check the alloc_workqueue return value in radeon_crtc_init() (Mika Penttilä) [RHEL-26909] {CVE-2023-52470}
  - USB: core: Fix hang in usb_kill_urb by adding memory barriers (Desnes Nunes) [RHEL-43979] {CVE-2022-48760}
  - cifs: fix bad fids sent over wire (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB311_posix_mkdir (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_tcon (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_open (Paulo Alcantara) [RHEL-52517]
  - smb3: add additional null check in SMB2_ioctl (Paulo Alcantara) [RHEL-52517]
  - selftests: forwarding: devlink_lib: Wait for udev events after reloading (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - drivers: core: synchronize really_probe() and dev_uevent() (Mark Langsdorf) [RHEL-47642] {CVE-2024-39501}
  - udp: do not accept non-tunnel GSO skbs landing in a tunnel (Xin Long) [RHEL-42997] {CVE-2024-35884}
  - filelock: Remove locks reliably when fcntl/close race is detected (Bill O'Donnell) [RHEL-50170] {CVE-2024-41012}
  - Input: add bounds checking to input_set_capability() (Benjamin Tissoires) [RHEL-21413] {CVE-2022-48619}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() (CKI Backport Bot) [RHEL-48130] {CVE-2024-40959}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued (Ming Lei) [RHEL-33695]
  - blk-cgroup: fix list corruption from resetting io stat (Ming Lei) [RHEL-33695]
  - net: do not leave a dangling sk pointer, when socket creation fails (CKI Backport Bot) [RHEL-48060] {CVE-2024-40954}
  - perf/x86/lbr: Filter vsyscall addresses (Michael Petlan) [RHEL-28991] {CVE-2023-52476}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() (CKI Backport Bot) [RHEL-47678] {CVE-2024-39499}
  - serial: core: fix transmit-buffer reset and memleak (Steve Best) [RHEL-38731] {CVE-2021-47527}
  - powerpc/pseries: Whitelist dtl slub object for copying to userspace (Mamatha Inamdar) [RHEL-51236] {CVE-2024-41065}
  - powerpc/eeh: avoid possible crash when edev->pdev changes (Mamatha Inamdar) [RHEL-51220] {CVE-2024-41064}
  - x86: stop playing stack games in profile_pc() (Steve Best) [RHEL-51643] {CVE-2024-42096}
  - mptcp: ensure snd_una is properly initialized on connect (Florian Westphal) [RHEL-47933 RHEL-47934] {CVE-2024-40931}
  - liquidio: Adjust a NULL pointer handling path in lio_vf_rep_copy_packet (CKI Backport Bot) [RHEL-47492] {CVE-2024-39506}
  - tun: add missing verification for short frame (Patrick Talbert) [RHEL-50194] {CVE-2024-41091}
  - tap: add missing verification for short frame (Patrick Talbert) [RHEL-50279] {CVE-2024-41090}
  - usb-storage: alauda: Check whether the media is initialized (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() (Desnes Nunes) [RHEL-43708] {CVE-2024-38619}
  - hwmon: (w83793) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37723] {CVE-2021-47384}
  - block: fix that util can be greater than 100% (Ming Lei) [RHEL-23074]
  - block: support to account io_ticks precisely (Ming Lei) [RHEL-23074]
  - watchdog: Fix possible use-after-free by calling del_timer_sync() (Steve Best) [RHEL-38795] {CVE-2021-47321}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37719] {CVE-2021-47385}
  - mlxsw: spectrum: Protect driver from buggy firmware (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - mlxsw: Verify the accessed index doesn't exceed the array length (CKI Backport Bot) [RHEL-42245] {CVE-2021-47560}
  - dm: call the resume method on internal suspend (Benjamin Marzinski) [RHEL-41835] {CVE-2024-26880}
  - tty: Fix out-of-bound vmalloc access in imageblit (Steve Best) [RHEL-37727] {CVE-2021-47383}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field (Steve Best) [RHEL-37715] {CVE-2021-47386}
  - hwmon: (mlxreg-fan) Return non-zero value when fan current state is enforced from sysfs (Steve Best) [RHEL-37710] {CVE-2021-47393}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells (Steve Best) [RHEL-38436] {CVE-2021-47497}
  - driver core: auxiliary bus: Fix memory leak when driver_register() fail (Steve Best) [RHEL-37901] {CVE-2021-47287}
  - phylib: fix potential use-after-free (cki-backport-bot) [RHEL-43764] {CVE-2022-48754}
  - ptp: Fix possible memory leak in ptp_clock_register() (Hangbin Liu) [RHEL-38424] {CVE-2021-47455}
  - NFSv4: Fix memory leak in nfs4_set_security_label (CKI Backport Bot) [RHEL-51315] {CVE-2024-41076}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER (CKI Backport Bot) [RHEL-51618] {CVE-2024-42090}
  - ftruncate: pass a signed offset (CKI Backport Bot) [RHEL-51598] {CVE-2024-42084}
  - af_unix: Fix garbage collector racing against connect() (Felix Maurer) [RHEL-34225] {CVE-2024-26923}
  - virtio-net: Add validation for used length (Laurent Vivier) [RHEL-42080] {CVE-2021-47352}
  - net: fix possible store tearing in neigh_periodic_work() (Antoine Tenart) [RHEL-42359] {CVE-2023-52522}
  - tunnels: fix out of bounds access when building IPv6 PMTU error (Antoine Tenart) [RHEL-41823] {CVE-2024-26665}
  - vt_ioctl: fix array_index_nospec in vt_setactivate (John W. Linville) [RHEL-49141] {CVE-2022-48804}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() (CKI Backport Bot) [RHEL-38302] {CVE-2023-52840}
  - netns: Make get_net_ns() handle zero refcount net (Antoine Tenart) [RHEL-48105] {CVE-2024-40958}
  - tracing: Ensure visibility when inserting an element into tracing_map (Michael Petlan) [RHEL-30457] {CVE-2024-26645}
  - KVM: s390: fix LPSWEY handling (CKI Backport Bot) [RHEL-50072]
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files (CKI Backport Bot) [RHEL-51144] {CVE-2024-41056}
  - SUNRPC: Fix a race to wake a sync task (Benjamin Coddington) [RHEL-11843]
  - firmware: cs_dsp: Fix overflow checking of wmfw header (CKI Backport Bot) [RHEL-50999] {CVE-2024-41039}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers (CKI Backport Bot) [RHEL-50987] {CVE-2024-41038}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() (Xin Long) [RHEL-48471] {CVE-2024-40995}
  - net: fix out-of-bounds access in ops_init (Xin Long) [RHEL-43185] {CVE-2024-36883}
  - x86/mce/therm_throt: Undo thermal polling properly on CPU offline (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Do not access uninitialized therm_work (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mark throttle_active_work() as __maybe_unused (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Mask out read-only and reserved MSR bits (Steve Best) [RHEL-45310]
  - x86/mce/therm_throt: Optimize notifications of thermal throttle (Steve Best) [RHEL-45310]
  - jiffies: add utility function to calculate delta in ms (Steve Best) [RHEL-45310]
  - x86/mce: Lower throttling MCE messages' priority to warning (Steve Best) [RHEL-45310]
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms (Eder Zulian) [RHEL-37361] {CVE-2024-35989}
  - xfs: don't walk off the end of a directory data block (CKI Backport Bot) [RHEL-50879] {CVE-2024-41013}
  - xfs: add bounds checking to xlog_recover_process_data (CKI Backport Bot) [RHEL-50856] {CVE-2024-41014}
  - dm-crypt: limit the size of encryption requests (Benjamin Marzinski) [RHEL-29330]
  - netfilter: flowtable: remove nf_ct_l4proto_find() call (Florian Westphal) [RHEL-49589]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.18.1.el8_10]
changelog:
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING (Ewan D. Milne) [RHEL-39805] {CVE-2024-36920}
  - tun: limit printing rate when illegal packet received by tun dev (Jon Maloy) [RHEL-35046] {CVE-2024-27013}
  - drm/amdgpu/debugfs: fix error code when smc register accessors are NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu: Fix a null pointer access when the smc_rreg pointer is NULL (Michel Dänzer) [RHEL-38210] {CVE-2023-52817}
  - drm/amdgpu/mes: fix use-after-free issue (Michel Dänzer) [RHEL-44043] {CVE-2024-38581}
  - drm/amdgpu: Fix the null pointer when load rlc firmware (Michel Dänzer) [RHEL-30603] {CVE-2024-26649}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' (Michel Dänzer) [RHEL-35160] {CVE-2024-27042}
  - net/sched: Fix UAF when resolving a clash (Xin Long) [RHEL-51014] {CVE-2024-41040}
  - tcp_metrics: validate source addr length (Guillaume Nault) [RHEL-52025] {CVE-2024-42154}
  - NFSv4/pnfs: Fix a use-after-free bug in open (Benjamin Coddington) [RHEL-35508]
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls (Benjamin Coddington) [RHEL-35508]
  - scsi: qedf: Make qedf_execute_tmf() non-preemptible (John Meneghini) [RHEL-51799] {CVE-2024-42124}
  - Input: elantech - fix stack out of bound access in elantech_change_report_id() (CKI Backport Bot) [RHEL-41938] {CVE-2021-47097}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect (CKI Backport Bot) [RHEL-28982] {CVE-2023-52478}
  - drm/radeon: fix UBSAN warning in kv_dpm.c (CKI Backport Bot) [RHEL-48399] {CVE-2024-40988}
  - usb: core: Don't hold the device lock while sleeping in do_proc_control() (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - USB: core: Make do_proc_control() and do_proc_bulk() killable (Desnes Nunes) [RHEL-43646] {CVE-2021-47582}
  - scsi: qedi: Fix crash while reading debugfs attribute (CKI Backport Bot) [RHEL-48327] {CVE-2024-40978}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery (CKI Backport Bot) [RHEL-48309] {CVE-2024-40977}
  - net: tcp: accept old ack during closing (Jamie Bainbridge) [RHEL-52433]
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation (CKI Backport Bot) [RHEL-48016] {CVE-2024-40941}
  - net/iucv: fix use after free in iucv_sock_close() (Mete Durlu) [RHEL-53988]
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids (CKI Backport Bot) [RHEL-47908] {CVE-2024-40929}
  - Input: aiptek - properly check endpoint type (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - use descriptors of current altsetting (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - Input: aiptek - fix endpoint sanity check (Benjamin Tissoires) [RHEL-48963] {CVE-2022-48836}
  - usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB (CKI Backport Bot) [RHEL-52373] {CVE-2024-42226}
  - wifi: mt76: replace skb_put with skb_put_zero (CKI Backport Bot) [RHEL-52366] {CVE-2024-42225}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() (CKI Backport Bot) [RHEL-47776] {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station (CKI Backport Bot) [RHEL-47758] {CVE-2024-40911}
  - VMCI: Use struct_size() in kmalloc() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix possible memcpy() run-time warning in vmci_datagram_invoke_guest_handler() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() (Steve Best) [RHEL-37325] {CVE-2024-35944}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values (Jose Ignacio Tornos Martinez) [RHEL-51761] {CVE-2024-42114}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() (CKI Backport Bot) [RHEL-51442] {CVE-2024-41097}
  - nfs: handle error of rpc_proc_register() in init_nfs_fs() (Scott Mayhew) [RHEL-39904] {CVE-2024-36939}
  - drm/radeon: check bo_va->bo is non-NULL before using it (CKI Backport Bot) [RHEL-51184] {CVE-2024-41060}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). (CKI Backport Bot) [RHEL-51027] {CVE-2024-41041}
  - USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor (CKI Backport Bot) [RHEL-50961] {CVE-2024-41035}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). (CKI Backport Bot) [RHEL-44408] {CVE-2024-37356}
  - tcp: avoid too many retransmit packets (Florian Westphal) [RHEL-48627] {CVE-2024-41007}
  - tcp: use signed arithmetic in tcp_rtx_probe0_timed_out() (Florian Westphal) [RHEL-48627]
  - net: tcp: fix unexcepted socket die when snd_wnd is 0 (Florian Westphal) [RHEL-48627]
  - tcp: refactor tcp_retransmit_timer() (Florian Westphal) [RHEL-48627]
  - tcp: exit if nothing to retransmit on RTO timeout (Florian Westphal) [RHEL-48627]
  - netfilter: nf_tables: Reject tables of unsupported family (Florian Westphal) [RHEL-21418] {CVE-2023-6040}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.19.1.el8_10]
changelog:
  - drm/i915/vma: Fix UAF on destroy against retire race (Mika Penttilä) [RHEL-35222] {CVE-2024-26939}
  - RHEL-48620 (Kenneth Yin) [RHEL-48620]
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() (CKI Backport Bot) [RHEL-42721] {CVE-2024-26855}
  - net: usb: asix: do not force pause frames support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix "can't send until first packet is send" issue (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix modprobe "sysfs: cannot create duplicate filename" (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: add proper error handling of usb read errors (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix wrong return value in asix_check_host_enable() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - asix: fix uninit-value in asix_mdio_read() (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: fix boolconv.cocci warnings (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: do not call phy_disconnect() for ax88178 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: move embedded PHY detection as early as possible (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: asix: fix uninit value bugs (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add missing stop (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: suspend PHY on driver probe (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: manage PHY PM from MAC (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: Fix less than zero comparison of a u16 (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: add error handling for asix_mdio_* functions (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: ax88772: add phylib support (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - net: usb: asix: refactor asix_read_phy_addr() and handle errors on return (Ken Cox) [RHEL-28108] {CVE-2021-47101}
  - SUNRPC: always free ctxt when freeing deferred request (Jay Shin) [RHEL-40936]
  - SUNRPC: double free xprt_ctxt while still in use (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove svc_rqst::rq_xprt_hlen (Jay Shin) [RHEL-40936]
  - SUNRPC: Remove dead code in svc_tcp_release_rqst() (Jay Shin) [RHEL-40936]
  - x86/bugs: Extend VMware Retbleed workaround to Nehalem & earlier CPUs (Waiman Long) [RHEL-48646]
  - wifi: iwlwifi: read txq->read_ptr under lock (Jose Ignacio Tornos Martinez) [RHEL-39797] {CVE-2024-36922}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload (John Meneghini) [RHEL-39908] {CVE-2024-36919}
  - nbd: always initialize struct msghdr completely (Ming Lei) [RHEL-29498] {CVE-2024-26638}
  - block: don't call rq_qos_ops->done_bio if the bio isn't tracked (Ming Lei) [RHEL-42151] {CVE-2021-47412}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment (Maurizio Lombardi) [RHEL-52013] {CVE-2024-42152}
  - ipv6: prevent NULL dereference in ip6_output() (Sabrina Dubroca) [RHEL-39912] {CVE-2024-36901}
  - ppp: reject claimed-as-LCP but actually malformed packets (Guillaume Nault) [RHEL-51052] {CVE-2024-41044}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() (CKI Backport Bot) [RHEL-54834] {CVE-2024-43830}
  - crypto: bcm - Fix pointer arithmetic (cki-backport-bot) [RHEL-44108] {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated (John Meneghini) [RHEL-44195] {CVE-2024-38559}
  - x86/bhi: Avoid warning in #DB handler due to BHI mitigation (Waiman Long) [RHEL-53657] {CVE-2024-42240}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory (CKI Backport Bot) [RHEL-47529] {CVE-2024-40901}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() (CKI Backport Bot) [RHEL-39843] {CVE-2024-36902}
  - net: usb: ax88179_178a: improve link status logs (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: improve reset check (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: fix link status when link is set to down/up (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - net: usb: ax88179_178a: avoid writing the mac address before first reading (Jose Ignacio Tornos Martinez) [RHEL-45167]
  - KVM: arm64: vgic-v2: Check for non-NULL vCPU in vgic_v2_parse_attr() (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - KVM: arm64: vgic-v2: Use cpuid from userspace as vcpu_id (Shaoqin Huang) [RHEL-40837] {CVE-2024-36953}
  - media: cec: cec-api: add locking in cec_release() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid confusing "transmit timed out" message (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: avoid recursive cec_claim_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: cec-adap: always cancel work in cec_transmit_msg_fh (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: remove length check of Timer Status (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: count low-drive, error and arb-lost conditions (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add note about *_from_edid() function usage in drm (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_unconfigured() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: add adap_nb_transmit_canceled() callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: don't set last_initiator if tx in progress (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: disable adapter in cec_devnode_unregister (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: core: not all messages were passed on when monitoring (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add support for Absolute Volume Control (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: log when claiming LA fails unexpectedly (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: drop activate_cnt, use state info instead (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: reconfigure if the PA changes during configuration (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: fix is_configuring state (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: stop trying LAs on CEC_TX_STATUS_TIMEOUT (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't unconfigure if already unconfigured (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add optional adap_configured callback (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: add xfer_timeout_ms field (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: use call_op and check for !unregistered (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix interrupt en/disable handling (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: drop unused 'enabled' field from struct cec_pin (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: fix off-by-one SFT check (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-pin: rename timer overrun variables (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: correctly pass on reply results (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: abort if the current transmit was canceled (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: call enable_adap on s_log_addrs (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: media/cec.h: document cec_adapter fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix a deadlock situation (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: safely unhook lists in cec_data (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: copy sequence field for the reply (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: fix trivial style warnings (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: add 'unregistered' checks (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec-adap.c: don't use flush_scheduled_work() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: Use fallthrough pseudo-keyword (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: remove unused waitq and phys_addrs fields (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: silence shift wrapping warning in __cec_s_log_addrs() (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - media: cec: move the core to a separate directory (Kate Hsuan) [RHEL-22559] {CVE-2024-23848}
  - net/iucv: Avoid explicit cpumask var allocation on stack (CKI Backport Bot) [RHEL-51631] {CVE-2024-42094}
  - scsi: lpfc: Handle mailbox timeouts in lpfc_get_sfp_info (Dick Kennedy) [RHEL-40400]
  - KVM: selftests: Make hyperv_clock require TSC based system clocksource (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Run clocksource dependent tests with hyperv_clocksource_tsc_page too (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Use generic sys_clocksource_is_tsc() in vmx_nested_tsc_scaling_test (Vitaly Kuznetsov) [RHEL-19027]
  - KVM: selftests: Generalize check_clocksource() from kvm_clock_test (Vitaly Kuznetsov) [RHEL-19027]
  - firmware: cs_dsp: Return error if block header overflows file (CKI Backport Bot) [RHEL-53646] {CVE-2024-42238}
  - firmware: cs_dsp: Validate payload length before processing block (CKI Backport Bot) [RHEL-53638] {CVE-2024-42237}
  - mm, slub: fix potential memoryleak in kmem_cache_open() (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - slub: don't panic for memcg kmem cache creation failure (Waiman Long) [RHEL-38404] {CVE-2021-47466}
  - wifi: ath11k: fix htt pktlog locking (Jose Ignacio Tornos Martinez) [RHEL-38317] {CVE-2023-52800}
  - wifi: ath11k: fix dfs radar event locking (Jose Ignacio Tornos Martinez) [RHEL-38165] {CVE-2023-52798}
  - lib/generic-radix-tree.c: Don't overflow in peek() (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - include/linux/generic-radix-tree.h: replace kernel.h with the necessary inclusions (Waiman Long) [RHEL-37737] {CVE-2021-47432}
  - EDAC/i10nm: Skip the absent memory controllers (Aristeu Rozanski) [RHEL-43236]
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() (John Meneghini) [RHEL-38197] {CVE-2023-52809}
  - gfs2: Fix potential glock use-after-free on unmount (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check (Andreas Gruenbacher) [RHEL-44149] {CVE-2024-38570}
  - nvme-fc: do not wait in vain when unloading module (Ewan D. Milne) [RHEL-33083] {CVE-2024-26846}
  - HID: hid-thrustmaster: fix OOB read in thrustmaster_interrupts (CKI Backport Bot) [RHEL-49698] {CVE-2022-48866}
  - scsi: qedf: Set qed_slowpath_params to zero before use (John Meneghini) [RHEL-9797]
  - scsi: qedf: Wait for stag work during unload (John Meneghini) [RHEL-9797]
  - scsi: qedf: Don't process stag work during unload and recovery (John Meneghini) [RHEL-9797]
  - Revert "mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again" (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - mm: avoid overflows in dirty throttling logic (Audra Mitchell) [RHEL-51840] {CVE-2024-42131}
  - mm/writeback: fix possible divide-by-zero in wb_dirty_limits(), again (Audra Mitchell) [RHEL-42625] {CVE-2024-26720}
  - ACPI: fix NULL pointer dereference (Mark Langsdorf) [RHEL-37897] {CVE-2021-47289}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.20.1.el8_10]
changelog:
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown (Shaoqin Huang) [RHEL-48417] {CVE-2024-40989}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() (CKI Backport Bot) [RHEL-55597] {CVE-2024-43871}
  - phy: ti: phy-omap-usb2: Fix NULL pointer dereference for SRP (Izabela Bakollari) [RHEL-26680] {CVE-2024-26600}
  - nvmet-fc: avoid deadlock on delete association path (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - nvmet-fc: release reference on target port (Maurizio Lombardi) [RHEL-31618] {CVE-2024-26769}
  - ACPI: LPIT: Avoid u32 multiplication overflow (Mark Langsdorf) [RHEL-37062] {CVE-2023-52683}
  - sched/deadline: Fix task_struct reference leak (Phil Auld) [RHEL-50904] {CVE-2024-41023}
  - nfsd: fix crash on LOCKT on reexported NFSv3 (Benjamin Coddington) [RHEL-31515]
  - mlxsw: spectrum_acl_tcam: Fix NULL pointer dereference in error path (CKI Backport Bot) [RHEL-26570] {CVE-2024-26595}
  - mlxsw: spectrum_acl_tcam: Move devlink param to TCAM code (Ivan Vecera) [RHEL-26570] {CVE-2024-26595}
  - ACPI: extlog: fix NULL pointer dereference check (Mark Langsdorf) [RHEL-29110] {CVE-2023-52605}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() (Mark Langsdorf) [RHEL-33198] {CVE-2024-26894}
  - mm: prevent derefencing NULL ptr in pfn_section_valid() (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - mm, kmsan: fix infinite recursion due to RCU critical section (Audra Mitchell) [RHEL-51132] {CVE-2024-41055}
  - cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options (Ondrej Mosnacek) [RHEL-30904]
  - cipso: fix total option length computation (Ondrej Mosnacek) [RHEL-30904]
  - ext4: do not create EA inode under buffer lock (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fold quota accounting into ext4_xattr_inode_lookup_create() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: check the return value of ext4_xattr_inode_dec_ref() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}
  - ext4: fix uninitialized ratelimit_state->lock access in __ext4_fill_super() (Carlos Maiolino) [RHEL-48507] {CVE-2024-40998}
  - ext4: remove duplicate definition of ext4_xattr_ibody_inline_set() (Carlos Maiolino) [RHEL-48271] {CVE-2024-40972}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.21.1.el8_10]
changelog:
  - s390/dasd: fix error recovery leading to data corruption on ESE devices (Mete Durlu) [RHEL-55874]
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions (CKI Backport Bot) [RHEL-55123] {CVE-2024-42265}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 (cki-backport-bot) [RHEL-44207] {CVE-2024-38558}
  - mlxsw: thermal: Fix out-of-bounds memory accesses (CKI Backport Bot) [RHEL-38375] {CVE-2021-47441}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages (CKI Backport Bot) [RHEL-47552] {CVE-2024-40904}
  - ipvs: properly dereference pe in ip_vs_add_service (Phil Sutter) [RHEL-54903] {CVE-2024-42322}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket (CKI Backport Bot) [RHEL-53702] {CVE-2024-42246}
  - drm/amdgpu: change vm->task_info handling (Michel Dänzer) [RHEL-49379] {CVE-2024-41008}
  - drm/amdgpu: Fix signedness bug in sdma_v4_0_process_trap_irq() (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: add error handle to avoid out-of-bounds (Michel Dänzer) [RHEL-45036] {CVE-2024-39471}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc (Michel Dänzer) [RHEL-52845] {CVE-2024-42228}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.22.1.el8_10]
changelog:
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing (Michal Schmidt) [RHEL-51278] {CVE-2024-41071}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.22.1.lve.el8_10]
changelog:
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.23.1.el8_10]
changelog:
  - ethtool: check device is present when getting link settings (Jamie Bainbridge) [RHEL-57002]
  - netfilter: nft_set_pipapo: do not free live element (Phil Sutter) [RHEL-34221] {CVE-2024-26924}
  - netfilter: nf_tables: missing iterator type in lookup walk (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nft_set_pipapo: walk over current view on netlink dump (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nftables: add helper function to flush set elements (Phil Sutter) [RHEL-35033] {CVE-2024-27017}
  - netfilter: nf_tables: prefer nft_chain_validate (Phil Sutter) [RHEL-51040] {CVE-2024-41042}
  - netfilter: nf_tables: fully validate NFT_DATA_VALUE on store to data registers (Phil Sutter) [RHEL-51516] {CVE-2024-42070}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() (Phil Sutter) [RHEL-43003] {CVE-2024-35898}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc (Phil Sutter) [RHEL-47606] {CVE-2024-39503}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range (Phil Sutter) [RHEL-42680] {CVE-2024-26851}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - dev/parport: fix the array out-of-bounds risk (Steve Best) [RHEL-54985] {CVE-2024-42301}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed (Sean Christopherson) [RHEL-35100] {CVE-2024-26976}
  - bnxt_re: avoid shift undefined behavior in bnxt_qplib_alloc_init_hwq (Kamal Heib) [RHEL-44279] {CVE-2024-38540}
  - tipc: Return non-zero value from tipc_udp_addr2str() on error (Xin Long) [RHEL-55069] {CVE-2024-42284}
  - Bluetooth: Fix TOCTOU in HCI debugfs implementation (CKI Backport Bot) [RHEL-26831] {CVE-2024-24857}
  - drm/i915/dpt: Make DPT object unshrinkable (CKI Backport Bot) [RHEL-47856] {CVE-2024-40924}
  - tipc: force a dst refcount before doing decryption (Xin Long) [RHEL-48363] {CVE-2024-40983}
  - block: initialize integrity buffer to zero before writing it to media (Ming Lei) [RHEL-54763] {CVE-2024-43854}
  - gso: do not skip outer ip header in case of ipip and net_failover (CKI Backport Bot) [RHEL-55790] {CVE-2022-48936}
  - drm/amdgpu: avoid using null object of framebuffer (CKI Backport Bot) [RHEL-51405] {CVE-2024-41093}
  - ipv6: prevent possible NULL deref in fib6_nh_init() (Guillaume Nault) [RHEL-48170] {CVE-2024-40961}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning (CKI Backport Bot) [RHEL-55568] {CVE-2024-43880}
  - ibmvnic: Add tx check to prevent skb leak (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - ibmvnic: rename local variable index to bufidx (CKI Backport Bot) [RHEL-51249] {CVE-2024-41066}
  - netfilter: bridge: replace physindev with physinif in nf_bridge_info (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: propagate net to nf_bridge_get_physindev (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nfnetlink_log: use proper helper for fetching physinif (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - netfilter: nf_queue: remove excess nf_bridge variable (Florian Westphal) [RHEL-37038 RHEL-37039] {CVE-2024-35839}
  - USB: serial: mos7840: fix crash on resume (CKI Backport Bot) [RHEL-53680] {CVE-2024-42244}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." (CKI Backport Bot) [RHEL-48381] {CVE-2024-40984}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.24.1.el8_10]
changelog:
  - cifs: do not set WorkstationName in NTLMSSP auth blob (Paulo Alcantara) [RHEL-56729]
  - padata: Fix possible divide-by-0 panic in padata_mt_helper() (Steve Best) [RHEL-56162] {CVE-2024-43889}
  - i40e: Fix wrong check for I40E_TXR_FLAGS_WB_ON_ITR (CKI Backport Bot) [RHEL-57000]
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). (Xin Long) [RHEL-56234] {CVE-2024-44935}
  - net/mlx5e: Fix netif state handling (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - net/mlx5e: Add wrapping for auxiliary_driver ops and remove unused args (Michal Schmidt) [RHEL-43864] {CVE-2024-38608}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. (cki-backport-bot) [RHEL-44031] {CVE-2024-38586}
  - netfilter: flowtable: initialise extack before use (Florian Westphal) [RHEL-58542] {CVE-2024-45018}
  - memcg: protect concurrent access to mem_cgroup_idr (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - memcontrol: ensure memcg acquired by id is properly set up (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm: memcontrol: fix cannot alloc the maximum memcg ID (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - mm/memcg: minor cleanup for MEM_CGROUP_ID_MAX (Rafael Aquini) [RHEL-56252] {CVE-2024-43892}
  - ice: Add netif_device_attach/detach into PF reset flow (CKI Backport Bot) [RHEL-23676]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.25.1.el8_10]
changelog:
  - cifs: modefromsids must add an ACE for authenticated users (Paulo Alcantara) [RHEL-56052]
  - cifs: do not use uninitialized data in the owner/group sid (Paulo Alcantara) [RHEL-56052]
  - cifs: fix set of group SID via NTSD xattrs (Paulo Alcantara) [RHEL-56052]
  - smb3: correct smb3 ACL security descriptor (Paulo Alcantara) [RHEL-56052]
  - smb3: fix possible access to uninitialized pointer to DACL (Paulo Alcantara) [RHEL-56052]
  - cifs: remove two cases where rc is set unnecessarily in sid_to_id (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix chmod with modefromsid when an older ACE already exists. (Paulo Alcantara) [RHEL-56052]
  - cifs: update new ACE pointer after populate_new_aces. (Paulo Alcantara) [RHEL-56052]
  - cifs: If a corrupted DACL is returned by the server, bail out. (Paulo Alcantara) [RHEL-56052]
  - cifs: cleanup a few le16 vs. le32 uses in cifsacl.c (Paulo Alcantara) [RHEL-56052]
  - cifs: Change SIDs in ACEs while transferring file ownership. (Paulo Alcantara) [RHEL-56052]
  - cifs: Retain old ACEs when converting between mode bits and ACL. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix cifsacl ACE mask for group and others. (Paulo Alcantara) [RHEL-56052]
  - Add SMB 2 support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - SMB3: Add support for getting and setting SACLs (Paulo Alcantara) [RHEL-56052]
  - cifs: Enable sticky bit with cifsacl mount option. (Paulo Alcantara) [RHEL-56052]
  - cifs: Fix unix perm bits to cifsacl conversion for "other" bits. (Paulo Alcantara) [RHEL-56052]
  - drm/i915/gt: Fix potential UAF by revoke of fence registers (Mika Penttilä) [RHEL-53633] {CVE-2024-41092}
  - scsi: lpfc: Validate hdwq pointers before dereferencing in reset/errata paths (Dick Kennedy) [RHEL-27224]
  - kobject_uevent: Fix OOB access within zap_modalias_env() (Rafael Aquini) [RHEL-55000] {CVE-2024-42292}
  - gfs2: Fix NULL pointer dereference in gfs2_log_flush (Andrew Price) [RHEL-51553] {CVE-2024-42079}
  - of: module: add buffer overflow check in of_modalias() (Charles Mirabile) [RHEL-44267] {CVE-2024-38541}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.26.1.el8_10]
changelog:
  - nouveau: lock the client object tree. (Abdiel Janulgue) [RHEL-35118] {CVE-2024-27062}
  - cifs: fix deadlock between reconnect and lease break (Paulo Alcantara) [RHEL-58037]
  - ACPI: PAD: fix crash in exit_round_robin() (Mark Langsdorf) [RHEL-56156]
  - gfs2: Randomize GLF_VERIFY_DELETE work delay (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Use mod_delayed_work in gfs2_queue_try_to_evict (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Update to the evict / remote delete documentation (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Clean up delete work processing (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Return enum evict_behavior from gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename dinode_demise to evict_behavior (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GIF_{DEFERRED -> DEFER}_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Faster gfs2_upgrade_iopen_glock wakeups (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Fix unlinked inode cleanup (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Initialize gl_no_formal_ino earlier (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename GLF_VERIFY_EVICT to GLF_VERIFY_DELETE (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: make timeout values more explicit (Wolfram Sang) [RHEL-35757]
  - gfs2: Simplify function gfs2_upgrade_iopen_glock (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Rename SDF_DEACTIVATING to SDF_KILL (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: Cease delete work during unmount (Bob Peterson) [RHEL-35757]
  - gfs2: Improve gfs2_upgrade_iopen_glock comment (Andreas Gruenbacher) [RHEL-35757]
  - gfs2: nit: gfs2_drop_inode shouldn't return bool (Bob Peterson) [RHEL-35757]
  - dmaengine: fix NULL pointer in channel unregistration function (Jerry Snitselaar) [RHEL-28867] {CVE-2023-52492}
  - dma-direct: Leak pages on dma_set_decrypted() failure (Jerry Snitselaar) [RHEL-37335] {CVE-2024-35939}
  - nfsd: fix delegation_blocked() to block correctly for at least 30 seconds (Olga Kornievskaia) [RHEL-41075]
  - NFSv4: Always ask for type with READDIR (Benjamin Coddington) [RHEL-39397]
  - cifs: get rid of unneeded conditional in cifs_get_num_sgs() (Paulo Alcantara) [RHEL-60251]
  - cifs: Get rid of unneeded conditional in the smb2_get_aead_req() (Paulo Alcantara) [RHEL-60251]
  - cifs: Remove duplicated include in cifsglob.h (Paulo Alcantara) [RHEL-60251]
  - cifs: fix oops during encryption (Paulo Alcantara) [RHEL-60251]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.27.1.el8_10]
changelog:
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() (Waiman Long) [RHEL-62139] {CVE-2024-47668}
  - bonding: fix xfrm real_dev null pointer dereference (Hangbin Liu) [RHEL-57239] {CVE-2024-44989}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok (Hangbin Liu) [RHEL-57233] {CVE-2024-44990}
  - bpf: Fix overrunning reservations in ringbuf (Viktor Malik) [RHEL-49414] {CVE-2024-41009}
  - xprtrdma: fix pointer derefs in error cases of rpcrdma_ep_create (CKI Backport Bot) [RHEL-49309] {CVE-2022-48773}
  - tty: tty_io: update timestamps on all device nodes (Aristeu Rozanski) [RHEL-55257]
  - tty: use 64-bit timstamp (Aristeu Rozanski) [RHEL-55257]
  - ELF: fix kernel.randomize_va_space double read (Rafael Aquini) [RHEL-60669] {CVE-2024-46826}
  - xfrm: set dst dev to blackhole_netdev instead of loopback_dev in ifdown (Xin Long) [RHEL-58100]
  - loopback: fix lockdep splat (Xin Long) [RHEL-58100]
  - blackhole_netdev: use blackhole_netdev to invalidate dst entries (Xin Long) [RHEL-58100]
  - loopback: create blackhole net device similar to loopack. (Xin Long) [RHEL-58100]


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.27.1.lve.el8_10]
changelog:
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.28.1.el8_10]
changelog:
  - s390/mm: Add cond_resched() to cmm_alloc/free_pages() (Mete Durlu) [RHEL-61702]
  - smb: client: fix deadlock in smb2_find_smb_tcon() (Paulo Alcantara) [RHEL-61400]
  - smb: client: fix potential deadlock when releasing mids (Paulo Alcantara) [RHEL-61400]
  - cifs: remove useless DeleteMidQEntry() (Paulo Alcantara) [RHEL-61400]
  - Bluetooth: af_bluetooth: Fix deadlock (CKI Backport Bot) [RHEL-58991]
  - gitlab-ci: provide consistent kcidb_tree_name (Michael Hofmann)
  - x86/mm/ident_map: Use gbpages only where full GB page should be mapped. (Nico Pache) [RHEL-26709]
  - audit: Send netlink ACK before setting connection in auditd_set (Richard Guy Briggs) [RHEL-14004]
  - KVM: selftests: x86: Fix test failure on arch lbr capable platforms (Maxim Levitsky) [RHEL-23999]
  - raid1: fix use-after-free for original bio in raid1_write_request() (Nigel Croxon) [RHEL-55263]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.29.1.el8_10]
changelog:
  - Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout (cki-backport-bot) [RHEL-36372] {CVE-2024-27399}
  - mptcp: pm: Fix uaf in __timer_delete_sync (Guillaume Nault) [RHEL-60614] {CVE-2024-46858}
  - cifs: fix dfs link failover in cifs_tree_connect() (Paulo Alcantara) [RHEL-8002]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.30.1.el8_10]
changelog:
  - media: edia: dvbdev: fix a use-after-free (Kate Hsuan) [RHEL-35763] {CVE-2024-27043}
  - blk-mq: fix missing blk_account_io_done() in error path (Ming Lei) [RHEL-61200]
  - rbd: don't assume rbd_is_lock_owner() for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: don't assume RBD_LOCK_STATE_LOCKED for exclusive mappings (Ilya Dryomov) [RHEL-52684]
  - rbd: rename RBD_LOCK_STATE_RELEASING and releasing_wait (Ilya Dryomov) [RHEL-52684]
  - smb: client: use actual path when queryfs (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory reads for oparms.mode (Paulo Alcantara) [RHEL-60363]
  - cifs: Fix uninitialized memory read for smb311 posix symlink create (Paulo Alcantara) [RHEL-60363]
  - cifs: convert the path to utf16 in smb2_query_info_compound (Paulo Alcantara) [RHEL-60363]
  - autofs: fix thinko in validate_dev_ioctl() (Ian Kent) [RHEL-62168]
  - autofs: add per dentry expire timeout (Ian Kent) [RHEL-62168]
  - bpf: Add BPF_PROG_TYPE_CGROUP_SKB attach type enforcement in BPF_LINK_CREATE (Viktor Malik) [RHEL-44167] {CVE-2024-38564}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.30.1.lve.el8_10]
changelog:
  - CLKRN-1683: do not lock up during fdinfo output
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.31.1.el8_10]
changelog:
  - xfrm: fix one more kernel-infoleak in algo dumping (Sabrina Dubroca) [RHEL-65955] {CVE-2024-50110}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() (Florian Westphal) [RHEL-66862] {CVE-2024-50256}
  - netfilter: nf_reject: Fix build warning when CONFIG_BRIDGE_NETFILTER=n (Florian Westphal) [RHEL-66862]
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() (Florian Westphal) [RHEL-66862]
  - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint() (Paulo Alcantara) [RHEL-7988]
  - cifs: handle cache lookup errors different than -ENOENT (Paulo Alcantara) [RHEL-7988]
  - cifs: don't take exclusive lock for updating target hints (Paulo Alcantara) [RHEL-7988]
  - cifs: avoid re-lookups in dfs_cache_find() (Paulo Alcantara) [RHEL-7988]
  - cifs: fix potential deadlock in cache_refresh_path() (Paulo Alcantara) [RHEL-7988]
  - cifs: don't refresh cached referrals from unactive mounts (Paulo Alcantara) [RHEL-7988]
  - cifs: return ENOENT for DFS lookup_cache_entry() (Paulo Alcantara) [RHEL-7988]
  - selinux,smack: don't bypass permissions check in inode_setsecctx hook (Ondrej Mosnacek) [RHEL-66104] {CVE-2024-46695}
  - gfs2: Prevent inode creation race (Andreas Gruenbacher) [RHEL-67823]
  - gfs2: Only defer deletes when we have an iopen glock (Andreas Gruenbacher) [RHEL-67823]
  - arm64: probes: Remove broken LDR (literal) uprobe support (Mark Salter) [RHEL-66042] {CVE-2024-50099}
  - net: avoid potential underflow in qdisc_pkt_len_init() with UFO (Davide Caratti) [RHEL-65399] {CVE-2024-49949}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset (Sabrina Dubroca) [RHEL-66457] {CVE-2024-50142}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.32.1.el8_10]
changelog:
  - irqchip/gic-v4: Correctly deal with set_affinity on lazily-mapped VPEs (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - irqchip/gic-v4: Don't allow a VMOVP on a dying VPE (Charles Mirabile) [RHEL-66965] {CVE-2024-50192}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race (Ming Lei) [RHEL-65158] {CVE-2024-50082}
  - gfs2: fix double destroy_workqueue error (Andreas Gruenbacher) [RHEL-62869]
  - Revert "GFS2: Don't add all glocks to the lru" (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Use list_move_tail instead of list_del/list_add_tail (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Revise glock reference counting model (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Switch to a per-filesystem glock workqueue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Report when glocks cannot be freed for a long time (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: gfs2_glock_get cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Invert the GLF_INITIAL flag (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename handle_callback to request_demote (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FROZEN to GLF_HAVE_FROZEN_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_REPLY_PENDING to GLF_HAVE_REPLY (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Rename GLF_FREEING to GLF_UNLOCKED (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove useless return statement in run_queue (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Remove unnecessary function prototype (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: finish_xmote cleanup (Andreas Gruenbacher) [RHEL-62869]
  - gfs2: Replace gfs2_glock_queue_put with gfs2_glock_put_async (Andreas Gruenbacher) [RHEL-62869]
  - KVM: selftests: memslot_perf_test: increase guest sync timeout (Maxim Levitsky) [RHEL-19080]
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans (Jon Maloy) [RHEL-68025] {CVE-2024-50264}
  - md/raid5: Wait sync io to finish before changing group cnt (Nigel Croxon) [RHEL-58585]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.33.1.el8_10]
changelog:
  - Revert "scsi: lpfc: Fix mbuf pool resource detected as busy at driver unload" This patch is dependent on the mbox refactor patch that was not added to rh8. (Dick Kennedy) [RHEL-64073]
  - drm/i915: Fix HPD polling, reenabling the output poll work as needed (Lyude Paul) [RHEL-62796]
  - drm: Add an HPD poll helper to reschedule the poll work (Lyude Paul) [RHEL-62796]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.34.1.el8_10]
changelog:
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust (Davide Caratti) [RHEL-69667] {CVE-2024-53122}
  - NFS: nfs_async_write_reschedule_io must not recurse into the writeback code (Benjamin Coddington) [RHEL-68647]
  - xfs: fix sparse inode limits on runt AG (Pavel Reichl) [RHEL-62924]
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration (Maxim Levitsky) [RHEL-67974]
  - x86/cpu/intel: Detect TME keyid bits before setting MTRR mask registers (Vitaly Kuznetsov) [RHEL-65362]
  - dlm: fix recovery of middle conversions (Alexander Aring) [RHEL-64860]
  - i40e: fix race condition by adding filter's intermediate sync state (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}
  - i40e: fix i40e_count_filters() to count only active/new filters (Michal Schmidt) [RHEL-68271] {CVE-2024-53088}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.35.1.el8_10]
changelog:
  - samples: pktgen: allow to specify destination port (Hangbin Liu) [RHEL-56480]
  - samples: pktgen: add some helper functions for port parsing (Hangbin Liu) [RHEL-56480]
  - scsi: storvsc: Do not flag MAINTENANCE_IN return of SRB_STATUS_DATA_OVERRUN as an error (Cathy Avery) [RHEL-71396]
  - scsi: storvsc: Handle additional SRB status values (Cathy Avery) [RHEL-71396]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.36.1.el8_10]
changelog:
  - cpufreq: intel_pstate: Support Emerald Rapids OOB mode (David Arcari) [RHEL-59649]
  - scsi: st: New session only when Unit Attention for new tape (John Meneghini) [RHEL-28790]
  - scsi: st: Add MTIOCGET and MTLOAD to ioctls allowed after device reset (John Meneghini) [RHEL-28790]
  - scsi: st: Don't modify unknown block number in MTIOCGET (John Meneghini) [RHEL-28790]
  - Reapply "scsi: st: Add third party poweron reset handling" (John Meneghini) [RHEL-28790]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.37.1.el8_10]
changelog:
  - arm64/sve: Discard stale CPU state when handling SVE traps (Mark Salter) [RHEL-71535] {CVE-2024-50275}
  - scsi: core: Handle devices which return an unusually large VPD page count (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Fix unremoved procfs host directory regression (Ewan D. Milne) [RHEL-34275]
  - scsi: core: Consult supported VPD page list prior to fetching page (Ewan D. Milne) [RHEL-34275]
  - NFSv4: Fix dropped lock for racing OPEN and delegation return (Benjamin Coddington) [RHEL-73889]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.38.1.el8_10]
changelog:
  - net: usb: lan78xx: add Allied Telesis AT29M2-AF (Jose Ignacio Tornos Martinez) [RHEL-70891]
  - s390/pci: Allow allocation of more than 1 MSI interrupt (Mete Durlu) [RHEL-74385]
  - s390/pci: Refactor arch_setup_msi_irqs() (Mete Durlu) [RHEL-74385]
  - s390/pci: Fix leak of struct zpci_dev when zpci_add_device() fails (Mete Durlu) [RHEL-71451]
  - s390/pci: Ignore RID for isolated VFs (Mete Durlu) [RHEL-71451]
  - s390/pci: Use topology ID for multi-function devices (Mete Durlu) [RHEL-71451]
  - s390/pci: Sort PCI functions prior to creating virtual busses (Mete Durlu) [RHEL-71451]
  - s390/iucv: MSG_PEEK causes memory leak in iucv_sock_destruct() (Mete Durlu) [RHEL-74387]
  - s390/pci: Handle PCI error codes other than 0x3a (Mete Durlu) [RHEL-74383]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.40.1.el8_10]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format (Desnes Nunes) [RHEL-69571] {CVE-2024-53104}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.41.1.el8_10]
changelog:
  - virtio-net: correctly enable callback during start_xmit (Laurent Vivier) [RHEL-72886]
  - dm snapshot: fix lockup in dm_exception_table_exit (Benjamin Marzinski) [RHEL-76230 RHEL-34599]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.42.1.el8_10]
changelog:
  - net: skb: exclude the single page frag cache for too small alloc (Paolo Abeni) [RHEL-66261]
  - NFSD: Reset cb_seq_status after NFS4ERR_DELAY (Olga Kornievskaia) [RHEL-79458]
  - mm: vmscan: account for free pages to prevent infinite Loop in throttle_direct_reclaim() (Seiji Nishikawa) [RHEL-64950]
  - scsi: st: Don't set pos_unknown just after device recognition (John Meneghini) [RHEL-78415]
  - ovl: fix use inode directly in rcu-walk mode (Miklos Szeredi) [RHEL-76161]
  - RDMA/cxgb4: Fix RDMA_CM_EVENT_UNREACHABLE error for iWARP (Kamal Heib) [RHEL-75826]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.43.1.el8_10]
changelog:
  - s390/module: fix loading modules with a lot of relocations (Mete Durlu) [RHEL-78999]
  - s390/module: Use s390_kernel_write() for late relocations (Mete Durlu) [RHEL-78999]
  - locking/atomic: Make test_and_*_bit() ordered on failure (Herton R. Krzesinski) [RHEL-69894]
  - pps: Fix a use-after-free (Michal Schmidt) [RHEL-77971]
  - KVM: s390: Change virtual to physical address access in diag 0x258 handler (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: gaccess: Check if guest address is in memslot (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: Fix SORTL and DFLTCC instruction format error in __insn32_query (Thomas Huth) [RHEL-68323 RHEL-65229]
  - s390/uv: Panic for set and remove shared access UVC errors (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for crypto control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - KVM: s390: vsie: Use virt_to_phys for facility control block (Thomas Huth) [RHEL-68323 RHEL-65229]
  - scsi: megaraid_sas: Fix for a potential deadlock (Tomas Henzl) [RHEL-21984] {CVE-2024-57807}
  - net/mlx5: Reload auxiliary devices in pci error handlers (Benjamin Poirier) [RHEL-78756]
  - net/mlx5: Suspend auxiliary devices only in case of PCI device suspend (Benjamin Poirier) [RHEL-78756]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.44.1.el8_10]
changelog:
  - HID: core: zero-initialize the report buffer (CKI Backport Bot) [RHEL-81825] {CVE-2024-50302}
  - ALSA: usb-audio: Fix a DMA to stack memory bug (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix for sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]
  - ALSA: usb-audio: Fix potential out-of-bound accesses for Extigy and Mbox devices (Jaroslav Kysela) [RHEL-81786] {CVE-2024-53197}
  - ALSA: usb-audio: Add sampling rates support for Mbox3 (Jaroslav Kysela) [RHEL-81786]


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.44.1.lve.el8_10]
changelog:
  - CLKRN-1769: call raid5_quiesce after suspending the md device
  - CLKRN-1683: do not lock up during fdinfo output
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.45.1.el8_10]
changelog:
  - gve: trigger RX NAPI instead of TX NAPI in gve_xsk_wakeup (Joshua Washington) [RHEL-73269]
  - gve: process XSK TX descriptors as part of RX NAPI (Joshua Washington) [RHEL-73269]
  - gve: guard XSK operations on the existence of queues (Joshua Washington) [RHEL-73269]
  - gve: guard XDP xmit NDO on existence of xdp queues (Joshua Washington) [RHEL-73269]
  - gve: Fix an edge case for TSO skb validity check (Joshua Washington) [RHEL-73269]
  - gve: Fix XDP TX completion handling when counters overflow (Joshua Washington) [RHEL-73269]
  - gve: Clear napi->skb before dev_kfree_skb_any() (Joshua Washington) [RHEL-73269] {CVE-2024-40937}
  - gve: ignore nonrelevant GSO type bits when processing TSO headers (Joshua Washington) [RHEL-73269]
  - can: bcm: Fix UAF in bcm_proc_show() (CKI Backport Bot) [RHEL-80733] {CVE-2023-52922}
  - gfs2: glock holder GL_NOPID fix (Andreas Gruenbacher) [RHEL-80694]
  - gfs2: Decode missing glock flags in tracepoints (Andreas Gruenbacher) [RHEL-80694]
  - net/smc: support ipv4 mapped ipv6 addr client for smc-r v2 (Mete Durlu) [RHEL-79810]
  - net: smc: fix spurious error message from __sock_release() (Mete Durlu) [RHEL-79812]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.46.1.el8_10]
changelog:
  - s390/pci: Fix handling of isolated VFs (Mete Durlu) [RHEL-81934]
  - s390/pci: Pull search for parent PF out of zpci_iov_setup_virtfn() (Mete Durlu) [RHEL-81934]
  - s390/pci: Fix SR-IOV for PFs initially in standby (Mete Durlu) [RHEL-81934]
  - x86/mm: Fix VDSO and VVAR placement on 5-level paging machines (Herton R. Krzesinski) [RHEL-62832]
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array (CKI Backport Bot) [RHEL-82720] {CVE-2025-21785}
  - nouveau/fence: handle cross device fences properly (Dave Airlie) [RHEL-80085]


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.46.1.lve.el8_10]
changelog:
  - CLKRN-1786: carefully stop the command thread in aacraid
  - CLKRN-1769: call raid5_quiesce after suspending the md device
  - CLKRN-1683: do not lock up during fdinfo output
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.47.1.el8_10]
changelog:
  - nfs: don't invalidate dentries on transient errors (Scott Mayhew) [RHEL-78136]
  - ethtool: runtime-resume netdev parent before ethtool ioctl ops (John J Coleman) [RHEL-78156]
  - bpf: Use raw_spinlock_t in ringbuf (Viktor Malik) [RHEL-79911] {CVE-2024-50138}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-549.el8]
changelog:
  - dm-integrity: align the outgoing bio in integrity_recheck (Benjamin Marzinski) [RHEL-29678]
  - dm-integrity: fix a memory leak when rechecking the data (Benjamin Marzinski) [RHEL-29678]
  - RDMA/mana_ib: Add CQ interrupt support for RAW QP (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: query device capabilities (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: register RDMA device with GDMA (Maxim Levitsky) [RHEL-23934]
  - net: mana: add msix index sharing between EQs (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix spelling mistake "enforecement" -> "enforcement" (Maxim Levitsky) [RHEL-23934]
  - net :mana :Add remaining GDMA stats for MANA to ethtool (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix oversized sge0 for GSO packets (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix TX CQE error handling (Maxim Levitsky) [RHEL-23934]
  - net: mana: Add gdma stats to ethtool output for mana (Maxim Levitsky) [RHEL-23934]
  - net: mana: Fix MANA VF unload when hardware is unresponsive (Maxim Levitsky) [RHEL-23934]
  - net: mana: Configure hwc timeout from hardware (Maxim Levitsky) [RHEL-23934]
  - RDMA/mana_ib: Use v2 version of cfg_rx_steer_req to enable RX coalescing (Maxim Levitsky) [RHEL-23934]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-550.el8]
changelog:
  - mm/sparsemem: fix race in accessing memory_section->usage (Waiman Long) [RHEL-28875 RHEL-28876] {CVE-2023-52489}
  - mm: use __pfn_to_section() instead of open coding it (Waiman Long) [RHEL-28875] {CVE-2023-52489}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-551.el8]
changelog:
  - x86/sev: Harden #VC instruction emulation somewhat (Vitaly Kuznetsov) [RHEL-30040] {CVE-2024-25743 CVE-2024-25742}
  - i40e: Fix VF MAC filter removal (Ivan Vecera) [RHEL-22992]
  - i40e: Do not allow untrusted VF to remove administratively set MAC (Ivan Vecera) [RHEL-22992]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.el8]
changelog:
  - i40e: Enforce software interrupt during busy-poll exit (Ivan Vecera) [RHEL-26248]
  - i40e: Remove _t suffix from enum type names (Ivan Vecera) [RHEL-26248]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.1.1.el8_10]
changelog:
  - redhat: set DIST to el8_10 and ZSTREAM to yes for 8.10 (Denys Vlasenko)
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc (Prarit Bhargava) [RHEL-32590] {CVE-2021-47185}
  - net: mana: Fix Rx DMA datasize and skb_over_panic (Cathy Avery) [RHEL-32579]
  - RDMA/srpt: Support specifying the srpt_service_guid parameter (Kamal Heib) [RHEL-31710] {CVE-2024-26744}
  - RDMA/qedr: Fix qedr_create_user_qp error flow (Kamal Heib) [RHEL-31714] {CVE-2024-26743}
  - hwmon: (coretemp) Fix out-of-bounds memory access (David Arcari) [RHEL-31305] {CVE-2024-26664}
  - RDMA/irdma: Fix KASAN issue with tasklet (Kamal Heib) [RHEL-15776]
  - net: bridge: use DEV_STATS_INC() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: Fix unwanted sign extension in netdev_stats_to_stats64() (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields (Ivan Vecera) [RHEL-27989] {CVE-2023-52578}
  - net/sched: act_ct: fix skb leak and crash on ooo frags (Xin Long) [RHEL-29467] {CVE-2023-52610}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg (Jose Ignacio Tornos Martinez) [RHEL-28015] {CVE-2023-52528}
  - RDMA/core: Fix uninit-value access in ib_get_eth_speed() (Kamal Heib) [RHEL-30130]
  - RDMA/core: Get IB width and speed from netdev (Kamal Heib) [RHEL-30130]
  - cpufreq: intel_pstate: Add Emerald Rapids support in no-HWP mode (Prarit Bhargava) [RHEL-29444]
  - powerpc/mm: Fix null-pointer dereference in pgtable_cache_add (Mamatha Inamdar) [RHEL-29118] {CVE-2023-52607}
  - powerpc/lib: Validate size for vector operations (Mamatha Inamdar) [RHEL-29114] {CVE-2023-52606}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors (Desnes Nunes) [RHEL-28986] {CVE-2023-52477}
  - media: uvcvideo: Fix OOB read (Desnes Nunes) [RHEL-27940] {CVE-2023-52565}
  - media: pvrusb2: fix use after free on context disconnection (Desnes Nunes) [RHEL-26498] {CVE-2023-52445}
  - i2c: i801: Fix block process call transactions (Prarit Bhargava) [RHEL-26478] {CVE-2024-26593}
  - overlay: disable EVM (Coiby Xu) [RHEL-19863]
  - evm: add support to disable EVM on unsupported filesystems (Coiby Xu) [RHEL-19863]
  - evm: don't copy up 'security.evm' xattr (Coiby Xu) [RHEL-19863]
  - net: ena: Remove ena_select_queue (Kamal Heib) [RHEL-14286]
  - media: dvbdev: Fix memory leak in dvb_media_device_free() (Prarit Bhargava) [RHEL-27254] {CVE-2020-36777}
  - gfs2: Fix invalid metadata access in punch_hole (Andrew Price) [RHEL-28784]
  - i2c: Fix a potential use after free (Prarit Bhargava) [RHEL-26849] {CVE-2019-25162}
  - i2c: validate user data in compat ioctl (Prarit Bhargava) [RHEL-27022] {CVE-2021-46934}
  - platform/x86: think-lmi: Fix reference leak (Prarit Bhargava) [RHEL-28030] {CVE-2023-52520}
  - vhost: use kzalloc() instead of kmalloc() followed by memset() (Jon Maloy) [RHEL-21505] {CVE-2024-0340}
  - RDMA/siw: Fix connection failure handling (Kamal Heib) [RHEL-28042] {CVE-2023-52513}
  - vt: fix memory overlapping when deleting chars in the buffer (Waiman Long) [RHEL-27778 RHEL-27779] {CVE-2022-48627}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer (Steve Best) [RHEL-26669] {CVE-2024-26603}
  - mptcp: fix double-free on socket dismantle (Davide Caratti) [RHEL-22773] {CVE-2024-26782}
  - crypto: akcipher - Disable signing and decryption (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: akcipher - default implementations for request callbacks (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - crypto: testmgr - split akcipher tests by a key type (Herbert Xu) [RHEL-17114] {CVE-2023-6240}
  - workqueue: Warn when a rescuer could not be created (Waiman Long) [RHEL-22136]
  - RDMA/cma: Avoid GID lookups on iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/cma: Deduplicate error flow in cma_validate_port() (Benjamin Coddington) [RHEL-12456]
  - RDMA/core: Set gid_attr.ndev for iWARP devices (Benjamin Coddington) [RHEL-12456]
  - RDMA/siw: Fabricate a GID on tun and loopback devices (Benjamin Coddington) [RHEL-12456]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.2.1.el8_10]
changelog:
  - s390/ptrace: handle setting of fpc register correctly (Tobias Huschle) [RHEL-29106] {CVE-2023-52598}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump (Tobias Huschle) [RHEL-27746] {CVE-2024-26615}
  - wifi: mac80211: fix race condition on enabling fast-xmit (Jose Ignacio Tornos Martinez) [RHEL-31664] {CVE-2024-26779}
  - powerpc/fadump: make is_kdump_kernel() return false when fadump is active (Mamatha Inamdar) [RHEL-24401]
  - vmcore: remove dependency with is_kdump_kernel() for exporting vmcore (Mamatha Inamdar) [RHEL-24401]
  - mtd: require write permissions for locking and badblock ioctls (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - mtd: properly check all write ioctls for permissions (Prarit Bhargava) [RHEL-27585] {CVE-2021-47055}
  - pid: take a reference when initializing `cad_pid` (Waiman Long) [RHEL-29420] {CVE-2021-47118}
  - i2c: i801: Don't generate an interrupt on bus reset (Prarit Bhargava) [RHEL-30325] {CVE-2021-47153}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup (Kamal Heib) [RHEL-33224] {CVE-2024-26872}
  - ceph: switch to corrected encoding of max_xattr_size in mdsmap (Xiubo Li) [RHEL-26723]
  - ceph: switch to use cap_delay_lock for the unlink delay list (Xiubo Li) [RHEL-32870]
  - ceph: pass ino# instead of old_dentry if it's disconnected (Xiubo Li) [RHEL-32870]
  - fat: fix uninitialized field in nostale filehandles (Andrey Albershteyn) [RHEL-33186 RHEL-35108] {CVE-2024-26973}
  - do_sys_name_to_handle(): use kzalloc() to fix kernel-infoleak (Andrey Albershteyn) [RHEL-33186] {CVE-2024-26901}
  - idpf: limit the support to GCP only (Michal Schmidt) [RHEL-15652]
  - redhat/configs: enable CONFIG_IDPF (Michal Schmidt) [RHEL-15652]
  - idpf: remove the use of ETHTOOL_RING_USE_TCP_DATA_SPLIT (Michal Schmidt) [RHEL-15652]
  - idpf: workaround for unavailable skb page recycling (Michal Schmidt) [RHEL-15652]
  - idpf: always allocate a full page (Michal Schmidt) [RHEL-15652]
  - idpf: remove page pool stats code (Michal Schmidt) [RHEL-15652]
  - idpf: add minimal macros for __free(kfree) to work (Michal Schmidt) [RHEL-15652]
  - idpf: fixup include paths for RHEL 8 (Michal Schmidt) [RHEL-15652]
  - idpf: fix kernel panic on unknown packet types (Michal Schmidt) [RHEL-15652]
  - idpf: disable local BH when scheduling napi for marker packets (Michal Schmidt) [RHEL-15652]
  - idpf: remove dealloc vector msg err in idpf_intr_rel (Michal Schmidt) [RHEL-15652]
  - idpf: fix minor controlq issues (Michal Schmidt) [RHEL-15652]
  - idpf: prevent deinit uninitialized virtchnl core (Michal Schmidt) [RHEL-15652]
  - idpf: cleanup virtchnl cruft (Michal Schmidt) [RHEL-15652]
  - idpf: refactor idpf_recv_mb_msg (Michal Schmidt) [RHEL-15652]
  - idpf: add async_handler for MAC filter messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor remaining virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor queue related virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: refactor vport virtchnl messages (Michal Schmidt) [RHEL-15652]
  - idpf: implement virtchnl transaction manager (Michal Schmidt) [RHEL-15652]
  - idpf: add idpf_virtchnl.h (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler padding in virtchnl2_ptype struct (Michal Schmidt) [RHEL-15652]
  - idpf: distinguish vports by the dev_port attribute (Michal Schmidt) [RHEL-15652]
  - idpf: avoid compiler introduced padding in virtchnl2_rss_key struct (Michal Schmidt) [RHEL-15652]
  - idpf: fix corrupted frames and skb leaks in singleq mode (Michal Schmidt) [RHEL-15652]
  - idpf: refactor some missing field get/prep conversions (Michal Schmidt) [RHEL-15652]
  - idpf: add get/set for Ethtool's header split ringparam (Michal Schmidt) [RHEL-15652]
  - idpf: fix potential use-after-free in idpf_tso() (Michal Schmidt) [RHEL-15652]
  - idpf: cancel mailbox work in error path (Michal Schmidt) [RHEL-15652]
  - idpf: set scheduling mode for completion queue (Michal Schmidt) [RHEL-15652]
  - idpf: add SRIOV support and other ndo_ops (Michal Schmidt) [RHEL-15652]
  - idpf: add ethtool callbacks (Michal Schmidt) [RHEL-15652]
  - idpf: add singleq start_xmit and napi poll (Michal Schmidt) [RHEL-15652]
  - idpf: add RX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add TX splitq napi poll support (Michal Schmidt) [RHEL-15652]
  - idpf: add splitq start_xmit (Michal Schmidt) [RHEL-15652]
  - idpf: initialize interrupts and enable vport (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for RX queues (Michal Schmidt) [RHEL-15652]
  - idpf: configure resources for TX queues (Michal Schmidt) [RHEL-15652]
  - idpf: add ptypes and MAC filter support (Michal Schmidt) [RHEL-15652]
  - idpf: add create vport and netdev configuration (Michal Schmidt) [RHEL-15652]
  - idpf: add core init and interrupt request (Michal Schmidt) [RHEL-15652]
  - idpf: add controlq init and reset checks (Michal Schmidt) [RHEL-15652]
  - idpf: add module register and probe functionality (Michal Schmidt) [RHEL-15652]
  - virtchnl: add virtchnl version 2 ops (Michal Schmidt) [RHEL-15652]
  - net: netdev_queue: netdev_txq_completed_mb(): fix wake condition (Michal Schmidt) [RHEL-15652]
  - net: piggy back on the memory barrier in bql when waking queues (Michal Schmidt) [RHEL-15652]
  - net: provide macros for commonly copied lockless queue stop/wake code (Michal Schmidt) [RHEL-15652]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-552.3.1.el8_10]
changelog:
  - netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout (Phil Sutter) [RHEL-30076] {CVE-2024-26643}
  - netfilter: nf_tables: disallow anonymous set with timeout flag (Phil Sutter) [RHEL-30080] {CVE-2024-26642}
  - selftests/bpf: Fix pyperf180 compilation failure with clang18 (Artem Savkov) [RHEL-35576]
  - md/raid5: fix atomicity violation in raid5_cache_count (Nigel Croxon) [RHEL-27930] {CVE-2024-23307}
  - usb: ulpi: Fix debugfs directory leak (Desnes Nunes) [RHEL-33287] {CVE-2024-26919}
  - powerpc/pseries: Fix potential memleak in papr_get_attr() (Mamatha Inamdar) [RHEL-35213] {CVE-2022-48669}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command (Desnes Nunes) [RHEL-35122] {CVE-2024-27059}
  - NFSv4: fairly test all delegations on a SEQ4_ revocation (Benjamin Coddington) [RHEL-34912]
  - USB: core: Fix deadlock in usb_deauthorize_interface() (Desnes Nunes) [RHEL-35002] {CVE-2024-26934}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma (Desnes Nunes) [RHEL-34958] {CVE-2024-26964}
  - fs: sysfs: Fix reference leak in sysfs_break_active_protection() (Ewan D. Milne) [RHEL-35076] {CVE-2024-26993}
  - xhci: handle isoc Babble and Buffer Overrun events properly (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - xhci: process isoc TD properly when there was a transaction error mid TD. (Desnes Nunes) [RHEL-31297] {CVE-2024-26659}
  - USB: core: Fix deadlock in port "disable" sysfs attribute (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - USB: core: Add hub_get() and hub_put() routines (Desnes Nunes) [RHEL-35006] {CVE-2024-26933}
  - netfilter: ipset: Missing gc cancellations fixed (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix performance regression in swap operation (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: Fix "INFO: rcu detected stall in hash_xxx" reports (Phil Sutter) [RHEL-30521]
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test (Phil Sutter) [RHEL-30521]
  - x86/apic/x2apic: Fix a NULL pointer deref when handling a dying cpu (David Arcari) [RHEL-32516]
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Make IA32_EMULATION boot time configurable (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}
  - x86: Introduce ia32_enabled() (Vitaly Kuznetsov) [RHEL-25087] {CVE-2024-25744}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.4.1.el8_10]
changelog:
  - cpuhotplug: Fix kABI breakage caused by CPUHP_AP_HYPERV_ONLINE (Vitaly Kuznetsov) [RHEL-36117]
  - net/mlx5e: Prevent deadlock while disabling aRFS (Kamal Heib) [RHEL-35041] {CVE-2024-27014}
  - x86/tsc: Defer marking TSC unstable to a worker (Wander Lairson Costa) [RHEL-32676]
  - x86/smpboot: Make TSC synchronization function call based (Wander Lairson Costa) [RHEL-32676]
  - net: usb: fix possible use-after-free in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}
  - net: usb: fix memory leak in smsc75xx_bind (Jose Ignacio Tornos Martinez) [RHEL-30311] {CVE-2021-47171}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.5.1.el8_10]
changelog:
  - tools/power/turbostat: Fix uncore frequency file string (David Arcari) [RHEL-29238]
  - tools/power turbostat: Expand probe_intel_uncore_frequency() (David Arcari) [RHEL-29238]
  - uio: Fix use-after-free in uio_open (Ricardo Robaina) [RHEL-26232] {CVE-2023-52439}
  - net:emac/emac-mac: Fix a use after free in emac_mac_tx_buf_send (Ken Cox) [RHEL-27316] {CVE-2021-47013}
  - keys: Fix linking a duplicate key to a keyring's assoc_array (David Howells) [RHEL-30772]
  - keys: Hoist locking out of __key_link_begin() (David Howells) [RHEL-30772]
  - keys: Break bits out of key_unlink() (David Howells) [RHEL-30772]
  - keys: Change keyring_serialise_link_sem to a mutex (David Howells) [RHEL-30772]
  - wifi: brcm80211: handle pmk_op allocation failure (Jose Ignacio Tornos Martinez) [RHEL-35150] {CVE-2024-27048}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work (Jose Ignacio Tornos Martinez) [RHEL-35140] {CVE-2024-27052}
  - wifi: iwlwifi: mvm: ensure offloading TID queue exists (Jose Ignacio Tornos Martinez) [RHEL-35130] {CVE-2024-27056}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() (Jose Ignacio Tornos Martinez) [RHEL-34866] {CVE-2024-26892}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete (Jose Ignacio Tornos Martinez) [RHEL-34189] {CVE-2024-26897}
  - wifi: iwlwifi: mvm: fix a crash when we run out of stations (Jose Ignacio Tornos Martinez) [RHEL-31547] {CVE-2024-26693}
  - wifi: iwlwifi: fix double-free bug (Jose Ignacio Tornos Martinez) [RHEL-31543] {CVE-2024-26694}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() (Jose Ignacio Tornos Martinez) [RHEL-29089] {CVE-2023-52594}
  - wifi: rt2x00: restart beacon queue when hardware reset (Jose Ignacio Tornos Martinez) [RHEL-29093] {CVE-2023-52595}
  - wifi: iwlwifi: fix a memory corruption (Jose Ignacio Tornos Martinez) [RHEL-28903] {CVE-2024-26610}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.5.1.lve.el8_10]
changelog:
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-548.el8]
changelog:
  - gitlab-ci: enable arm64/s390x/ppc64le debug builds (Michael Hofmann)
  - arm64: Add missing bits of AmpereOne Spectre-BHB mitigation (Mark Salter) [RHEL-29005]
  - [rt] enable CONFIG_DRM_MGAG200_IOBURST_WORKAROUND (Jocelyn Falempe) [RHEL-13214]
  - drm/mgag200: Add a workaround for low-latency (Jocelyn Falempe) [RHEL-13214]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.48.1.el8_10]
changelog:
  - rhel-8.10: gate kernel on kernel-qe tests results not cki ones (Bruno Goncalves)
  - gfs2: skip if we cannot defer delete (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove redundant warnings (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: minor evict fix (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Prevent inode creation race (2) (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix additional unlikely request cancelation race (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Fix request cancelation bug (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Check for empty queue in run_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove more dead code in add_to_queue (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: remove dead code in add_to_queue (Su Hui) [RHEL-76208]
  - gfs2: Remove LM_FLAG_PRIORITY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Replace GIF_DEFER_DELETE with GLF_DEFER_DELETE (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Add GLF_PENDING_REPLY flag (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove and replace gfs2_glock_queue_work (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: do_xmote fixes (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Clear flags when withdraw prevents xmote (Bob Peterson) [RHEL-76208]
  - gfs2: fix a deadlock on withdraw-during-mount (Bob Peterson) [RHEL-76208]
  - gfs2: gfs2_evict_inode clarification (Andreas Gruenbacher) [RHEL-76208]
  - gfs2: Remove misleading comments in gfs2_evict_inode (Andreas Gruenbacher) [RHEL-76208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.49.1.el8_10]
changelog:
  - net/mlx5: Fix error path in multi-packet WQE transmit (CKI Backport Bot) [RHEL-84244]
  - redhat: drop Y issues from changelog (Jan Stancek)
  - md/md-bitmap: fix writing non bitmap changes local to RHEL (Nigel Croxon) [RHEL-80673]
  - md/md-bitmap: fix writing non bitmap pages (Nigel Croxon) [RHEL-80673]
  - md-bitmap: use %pD to print the file name in md_bitmap_file_kick (Nigel Croxon) [RHEL-80673]
  - md-bitmap: initialize variables at declaration time in md_bitmap_file_unmap (Nigel Croxon) [RHEL-80673]
  - md-bitmap: set BITMAP_WRITE_ERROR in write_sb_page (Nigel Croxon) [RHEL-80673]
  - raid1: update discard granularity when adding new disk (Nigel Croxon) [RHEL-71499]
  - x86/xen: remove hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}
  - x86/xen: use new hypercall functions instead of hypercall page (Vitaly Kuznetsov) [RHEL-70666] {CVE-2024-53241}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.50.1.el8_10]
changelog:
  - perf debug: Set debug_peo_args and redirect_to_stderr variable to correct values in perf_quiet_option() (Michael Petlan) [RHEL-82119]
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources (Jarod Wilson) [RHEL-86737] {CVE-2024-53150}
  - scsi: storvsc: Set correct data length for sending SCSI command without payload (Cathy Avery) [RHEL-83052]
  - ice: fold ice_ptp_read_time into ice_ptp_gettimex64 (Michal Schmidt) [RHEL-85852]
  - ice: avoid the PTP hardware semaphore in gettimex64 path (Michal Schmidt) [RHEL-85852]
  - ice: add ice_adapter for shared data across PFs on the same NIC (Michal Schmidt) [RHEL-85852]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.51.1.el8_10]
changelog:
  - x86/xen: use the whole RCX when picking the right hypercall function (Vitaly Kuznetsov) [RHEL-87072]
  - Revert "usb: xhci: prevent potential failure in handle_tx_event() for Transfer events without TRB" (Desnes Nunes) [RHEL-87280]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.52.1.el8_10.gfd1b]
changelog:
  - netfilter: ipset: add missing range check in bitmap_ip_uadt (Florian Westphal) [RHEL-70268] {CVE-2024-53141}
  - NFS: Extend rdirplus mount option with "force|none" (Benjamin Coddington) [RHEL-16285]
  - idpf: trigger SW interrupt when exiting wb_on_itr mode (Michal Schmidt) [RHEL-73266]
  - idpf: add support for SW triggered interrupts (Michal Schmidt) [RHEL-73266]
  - idpf: fix VF dynamic interrupt ctl register initialization (Michal Schmidt) [RHEL-73266]
  - idpf: enable WB_ON_ITR (Michal Schmidt) [RHEL-73266]
  - redhat: require recent enough linux-firmware for qed (Denys Vlasenko) [RHEL-6342]
  - gfs2: deallocate inodes in gfs2_create_inode (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move GIF_ALLOC_FAILED check out of gfs2_ea_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Move gfs2_dinode_dealloc (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: Don't reread inodes unnecessarily (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: gfs2_create_inode error handling fix (Andreas Gruenbacher) [RHEL-7875]
  - gfs2: No longer use 'extern' in function declarations (Andreas Gruenbacher) [RHEL-7875]
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() (CKI Backport Bot) [RHEL-63668] {CVE-2022-49011}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.52.1.lve.el8_10]
changelog:
  - CLKRN-1855: aacraid: add bug_on to catch fibs list corruptions earlier
  - CLKRN-1786: carefully stop the command thread in aacraid
  - CLKRN-1769: call raid5_quiesce after suspending the md device
  - CLKRN-1683: do not lock up during fdinfo output
  - CLKRN-1676: exclude deps to shim from 7h build
  - CLKRN-1671: disable WBT by default
  - CLKRN-1596: fixed memcg_reclaim_boost_priority size
  - CLKRN-1556: avoiding a potential hung task within cg mem reclaim
  - CLKRN-1514: additional debug/initialization of new inodes
  - CLPKG-1145: Add conflicts for shim versions before 15.8-1.el8.cloudlinux.1
  - KB-271: build perf on 7h without libtraceevent
  - KB-252: add dependency to kmod 25-19.cloudlinux.2
  - CLKRN-1096: force to load modern kmod in order kabi breakage.
  - CLKRN-1052: deadlock between prealloc truncate and fs unfreeze


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.53.1.el8_10]
changelog:
  - net/mlx5: Always stop health timer during driver removal (Michal Schmidt) [RHEL-47712] {CVE-2024-40906}
  - net/mlx5: Split function_setup() to enable and open functions (Michal Schmidt) [RHEL-47712]
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink (Michal Schmidt) [RHEL-57117] {CVE-2024-44970}
  - net/mlx5e: SHAMPO, Fix incorrect page release (Michal Schmidt) [RHEL-57117] {CVE-2024-46717}
  - s390/pci: Fix zpci_bus_is_isolated_vf() for non-VFs (Mete Durlu) [RHEL-88819]
  - platform/x86: dell-wmi-sysman: Make init_bios_attributes() ACPI object parsing more robust (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup create_attributes_level_sysfs_files() (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make sysman_init() return -ENODEV of the interfaces are not found (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Cleanup sysman_init() error-exit handling (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix release_attributes_data() getting called twice on init_bios_attributes() failure (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Make it safe to call exit_foo_attributes() multiple times (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix possible NULL pointer deref on exit (Jay Shin) [RHEL-88714]
  - platform/x86: dell-wmi-sysman: Fix crash caused by calling kset_unregister twice (Jay Shin) [RHEL-88714]
  - x86/kexec: Add EFI config table identity mapping for kexec kernel (Herton R. Krzesinski) [RHEL-71793]
  - vsock: Orphan socket after transport release (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - vsock: Keep the binding until socket destruction (Jay Shin) [RHEL-89099] {CVE-2025-21756}
  - bpf, vsock: Invoke proto::close on close() (Jay Shin) [RHEL-89099] {CVE-2025-21756}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.54.1.el8_10]
changelog:
  - ice: fix stats being updated by way too large values (CKI Backport Bot) [RHEL-70834]
  - wifi: rtw89: Fix array index mistake in rtw89_sta_info_get_iter() (CKI Backport Bot) [RHEL-54802] {CVE-2024-43842}
  - sched/rt: Fix race in push_rt_task (Phil Auld) [RHEL-84963]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.56.1.el8_10]
changelog:
  - tools/power/x86_energy_perf_policy: Read energy_perf_bias from sysfs (David Arcari) [RHEL-86963]
  - um: Fix out-of-bounds read in LDT setup (CKI Backport Bot) [RHEL-90261] {CVE-2022-49395}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.57.1.el8_10]
changelog:
  - smb: client: fix warning in cifs_smb3_do_mount() (Paulo Alcantara) [RHEL-55825]
  - cifs: fix double free race when mount fails in cifs_get_root() (Paulo Alcantara) [RHEL-55825] {CVE-2022-48919}
  - security/keys: fix slab-out-of-bounds in key_task_permission (CKI Backport Bot) [RHEL-68090] {CVE-2024-50301}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.58.1.el8_10]
changelog:
  - ndisc: use RCU protection in ndisc_alloc_skb() (Xin Long) [RHEL-89535] {CVE-2025-21764}
  - ipv6: use RCU protection in ip6_default_advmss() (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: add dev_net_rcu() helper (Xin Long) [RHEL-89535] {CVE-2025-21765}
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu() (Xin Long) [RHEL-89535]
  - idpf: check error for register_netdev() on init (Michal Schmidt) [RHEL-71182] {CVE-2025-22116}
  - idpf: avoid mailbox timeout delays during reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix a race in txq wakeup (Michal Schmidt) [RHEL-71182]
  - idpf: fix idpf_vport_splitq_napi_poll() (Michal Schmidt) [RHEL-71182]
  - idpf: fix null-ptr-deref in idpf_features_check (Michal Schmidt) [RHEL-71182]
  - idpf: protect shutdown from reset (Michal Schmidt) [RHEL-71182]
  - idpf: fix potential memory leak on kcalloc() failure (Michal Schmidt) [RHEL-71182]
  - idpf: fix offloads support for encapsulated packets (Michal Schmidt) [RHEL-71182]
  - idpf: fix adapter NULL pointer dereference on reboot (Michal Schmidt) [RHEL-71182] {CVE-2025-22065}
  - idpf: fix checksums set in idpf_rx_rsc() (Michal Schmidt) [RHEL-71182] {CVE-2025-21890}
  - idpf: fix handling rsc packet with a single segment (Michal Schmidt) [RHEL-71182]
  - idpf: add more info during virtchnl transaction timeout/salt mismatch (Michal Schmidt) [RHEL-71182]
  - idpf: convert workqueues to unbound (Michal Schmidt) [RHEL-71182] {CVE-2024-58057}
  - idpf: Acquire the lock before accessing the xn->salt (Michal Schmidt) [RHEL-71182]
  - idpf: fix transaction timeouts on reset (Michal Schmidt) [RHEL-71182]
  - idpf: add read memory barrier when checking descriptor done bit (Michal Schmidt) [RHEL-71182]
  - idpf: deinit virtchnl transaction manager after vport and vectors (Michal Schmidt) [RHEL-71182]
  - idpf: use actual mbx receive payload length (Michal Schmidt) [RHEL-71182]
  - idpf: call set_real_num_queues in idpf_open (Michal Schmidt) [RHEL-71182 RHEL-90849]
  - idpf: fix idpf_vc_core_init error path (Michal Schmidt) [RHEL-68233 RHEL-71182 RHEL-90846] {CVE-2024-53064}
  - idpf: avoid vport access in idpf_get_link_ksettings (Michal Schmidt) [RHEL-71182 RHEL-90846] {CVE-2024-50274}
  - idpf: fix netdev Tx queue stop/wake (Michal Schmidt) [RHEL-71182]
  - idpf: fix UAFs when destroying the queues (Michal Schmidt) [RHEL-71182] {CVE-2024-44932}
  - idpf: fix memleak in vport interrupt configuration (Michal Schmidt) [RHEL-71182]
  - idpf: fix memory leaks and crashes while performing a soft reset (Michal Schmidt) [RHEL-71182] {CVE-2024-44964}
  - idpf: compile singleq code only under default-n CONFIG_IDPF_SINGLEQ (Michal Schmidt) [RHEL-71182]
  - redhat/configs: set CONFIG_IDPF_SINGLEQ as disabled (Michal Schmidt) [RHEL-71182]
  - idpf: merge singleq and splitq &net_device_ops (Michal Schmidt) [RHEL-71182]
  - idpf: avoid bloating &idpf_q_vector with big %NR_CPUS (Michal Schmidt) [RHEL-71182]
  - idpf: split &idpf_queue into 4 strictly-typed queue structures (Michal Schmidt) [RHEL-71182]
  - idpf: remove legacy Page Pool Ethtool stats (Michal Schmidt) [RHEL-71182]
  - net: remove gfp_mask from napi_alloc_skb() [idpf] (Michal Schmidt) [RHEL-71182]
  - idpf: stop using macros for accessing queue descriptors (Michal Schmidt) [RHEL-71182]
  - idpf: don't enable NAPI and interrupts prior to allocating Rx buffers (Michal Schmidt) [RHEL-71182]
  - idpf: Interpret .set_channels() input differently (Michal Schmidt) [RHEL-71182]
  - idpf: make virtchnl2.h self-contained (Michal Schmidt) [RHEL-71182]
  - s390/pci: Serialize device addition and removal (Mete Durlu) [RHEL-95783]
  - s390/pci: Allow re-add of a reserved but not yet removed device (Mete Durlu) [RHEL-95783]
  - s390/pci: Prevent self deletion in disable_slot() (Mete Durlu) [RHEL-95783]
  - s390/pci: Remove redundant bus removal and disable from zpci_release_device() (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix duplicate pci_dev_put() in disable_slot() when PF has child VFs (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix missing check for zpci_create_device() error return (Mete Durlu) [RHEL-95783]
  - s390/pci: Fix potential double remove of hotplug slot (Mete Durlu) [RHEL-95783]
  - s390/pci: remove hotplug slot when releasing the device (Mete Durlu) [RHEL-95783]
  - s390/pci: introduce lock to synchronize state of zpci_dev's (Mete Durlu) [RHEL-95783]
  - s390/pci: rename lock member in struct zpci_dev (Mete Durlu) [RHEL-95783]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.59.1.el8_10]
changelog:
  - SUNRPC: Fix Oops in xs_tcp_send_request() when transport is disconnected (Olga Kornievskaia) [RHEL-83291]
  - SUNRPC: Set TCP_CORK until the transmit queue is empty (Olga Kornievskaia) [RHEL-83291]
  - tcp: add tcp_sock_set_cork (Olga Kornievskaia) [RHEL-83291]
  - xfs: xfs_ail_push_all_sync() stalls when racing with updates (Brian Foster) [RHEL-88132]
  - Bluetooth: Fix use after free in hci_send_acl (CKI Backport Bot) [RHEL-90428] {CVE-2022-49111}
  - Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: add lock to protect HCI_UNREGISTER (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: Cancel sync command before suspend and power off (David Marlin) [RHEL-90468] {CVE-2022-49136}
  - Bluetooth: hci_sync: Fix queuing commands when HCI_UNREGISTER is set (CKI Backport Bot) [RHEL-90468] {CVE-2022-49136}
  - fix backport of "filelock: Remove locks reliably when fcntl/close race is detected" (Scott Mayhew) [RHEL-89709]
  - NFSv4: Allow FREE_STATEID to clean up delegations (Benjamin Coddington) [RHEL-86932]
  - NFSv4.1: constify the stateid argument in nfs41_test_stateid() (Trond Myklebust) [RHEL-86932]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.60.1.el8_10]
changelog:
  - xfs: don't allocate COW extents when unsharing a hole (Brian Foster) [RHEL-83037]
  - xfs: don't allocate into the data fork for an unshare request (Brian Foster) [RHEL-83037]
  - s390/ism: add release function for struct device (Mete Durlu) [RHEL-97192]
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() (CKI Backport Bot) [RHEL-99113] {CVE-2022-49846}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.61.1.el8_10]
changelog:
  - s390: Add z17 elf platform (Christoph Schlameuss) [RHEL-100409]
  - ext4: ignore xattrs past end (CKI Backport Bot) [RHEL-100375] {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split (CKI Backport Bot) [RHEL-100361] {CVE-2025-23150}
  - net: atm: fix use after free in lec_send() (CKI Backport Bot) [RHEL-93119] {CVE-2025-22004}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes (CKI Backport Bot) [RHEL-98980] {CVE-2025-21991}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.62.1.el8_10]
changelog:
  - s390/virtio_ccw: Don't allocate/assign airqs for non-existing queues (David Hildenbrand) [RHEL-87557]
  - mm/slab: make __free(kfree) accept error pointers (Mark Langsdorf) [RHEL-84410]
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-84410]
  - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-84410]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Adjust scoped_guard() macros to avoid potential warning (Mark Langsdorf) [RHEL-84410]
  - cleanup: Remove address space of returned pointer (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add usage and style documentation (Mark Langsdorf) [RHEL-84410]
  - file: add take_fd() cleanup helper (Mark Langsdorf) [RHEL-84410]
  - cleanup: Standardize the header guard define's name (Mark Langsdorf) [RHEL-84410]
  - cleanup: Add conditional guard support (Mark Langsdorf) [RHEL-84410]
  - cleanup: Make no_free_ptr() __must_check (Mark Langsdorf) [RHEL-84410]
  - locking: Introduce __cleanup() based infrastructure (Mark Langsdorf) [RHEL-84410]
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() (CKI Backport Bot) [RHEL-100343] {CVE-2022-49788}
  - media: uvcvideo: Announce the user our deprecation intentions (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Allow changing noparam on the fly (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Invert default value for nodrop module param (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Propagate buf->error to userspace (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Flush the control cache when we get an event (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Annotate lock requirements for uvc_ctrl_set (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Remove dangling pointers (Desnes Nunes) [RHEL-98760] {CVE-2024-58002}
  - media: uvcvideo: Remove redundant NULL assignment (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Only save async fh if success (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Refactor iterators (Desnes Nunes) [RHEL-98760]
  - media: uvcvideo: Fix double free in error path (CKI Backport Bot) [RHEL-98788] {CVE-2024-57980}
  - cifs: potential buffer overflow in handling symlinks (Paulo Alcantara) [RHEL-97074] {CVE-2022-49058}
  - Race between reading mdstat and stopping an md device (Nigel Croxon) [RHEL-95723]
  - fs/dcache: Control # of dentries in list_lru_node (Waiman Long) [RHEL-8578]
  - fs/dcache: Add sysctl parameter dentry-fs-klimit to control # of dentries in filesystem (Waiman Long) [RHEL-8578]
  - mm/list_lru: Make list_lru_add() return # if items in affected list_lru_node (Waiman Long) [RHEL-8578]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.63.1.el8_10]
changelog:
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). (Guillaume Nault) [RHEL-66324] {CVE-2024-50154}
  - net: ch9200: fix uninitialised access during mii_nway_restart (CKI Backport Bot) [RHEL-101200] {CVE-2025-38086}
  - mm/swapfile: add cond_resched() in get_swap_pages() (Nico Pache) [RHEL-80401] {CVE-2023-52932}
  - dlm: fix possible lkb_resource null dereference (Alexander Aring) [RHEL-64452]
  - fs: dlm: handle -EINVAL as log_error() (Alexander Aring) [RHEL-64452]
  - redhat/configs: enable CONFIG_RH_KABI_STABLE_ASM_OFFSETS (Čestmír Kalina) [RHEL-90099]
  - kabi: freeze stablelist and stackprotector-related constants (Čestmír Kalina) [RHEL-90099]
  - kabi: add redhat/kabi/asm-offsets (Čestmír Kalina) [RHEL-90099]
  - kabi: add RH_KABI_ASSERT_EQ_CONST{,EXPR} (Čestmír Kalina) [RHEL-90099]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.64.1.el8_10]
changelog:
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list (CKI Backport Bot) [RHEL-100387] {CVE-2025-21919}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN (Benjamin Coddington) [RHEL-86256]
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead (CKI Backport Bot) [RHEL-102133] {CVE-2022-49977}
  - wifi: iwlwifi: limit printed string from FW file (CKI Backport Bot) [RHEL-99367] {CVE-2025-21905}
  - workqueue: Disable printk_deferred_{enter,exit} in RT kernel (Waiman Long) [RHEL-80292]
  - workqueue: Make show_pwq() use run-length encoding (Waiman Long) [RHEL-80292]
  - workqueue: Introduce show_one_worker_pool and show_one_workqueue. (Waiman Long) [RHEL-80292]
  - workqueue: fix state-dump console deadlock (Waiman Long) [RHEL-80292]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.65.1.el8_10]
changelog:
  - x86/alternatives: avoid mapping FIX_TEXT_POKE1 page when it is not required (Rafael Aquini) [RHEL-95422]
  - ext4: avoid resizing to a partial cluster size (CKI Backport Bot) [RHEL-101423] {CVE-2022-50020}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.66.1.el8_10]
changelog:
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice (Xin Long) [RHEL-105415] {CVE-2025-38001}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() (Xin Long) [RHEL-105415] {CVE-2025-38000}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc (CKI Backport Bot) [RHEL-105415] {CVE-2025-37890}
  - sch_hfsc: make hfsc_qlen_notify() idempotent (Xin Long) [RHEL-105415]
  - crypto: algif_hash - fix double free in hash_accept (CKI Backport Bot) [RHEL-102223] {CVE-2025-38079}
  - Revert "smb: client: fix TCP timers deadlock after rmmod" (Paulo Alcantara) [RHEL-100698] {CVE-2025-22077}
  - Revert "smb: client: Fix netns refcount imbalance causing leaks and use-after-free" (Paulo Alcantara) [RHEL-100698]
  - smb: client: Fix netns refcount imbalance causing leaks and use-after-free (Paulo Alcantara) [RHEL-100698]
  - smb: client: fix TCP timers deadlock after rmmod (Paulo Alcantara) [RHEL-100698] {CVE-2024-54680}
  - smb: client: Fix use-after-free of network namespace. (Paulo Alcantara) [RHEL-100698] {CVE-2024-53095}
  - smb: client: fix warning in generic_ip_connect() (Paulo Alcantara) [RHEL-100698]
  - net: tipc: fix refcount warning in tipc_aead_encrypt (Xin Long) [RHEL-103079]
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done (CKI Backport Bot) [RHEL-103079] {CVE-2025-38052}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove (CKI Backport Bot) [RHEL-99013] {CVE-2025-22020}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() (CKI Backport Bot) [RHEL-98837] {CVE-2025-21928}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.67.1.el8_10]
changelog:
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix collapse_pte_mapped_thp() to allow anon_vma (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: take the right locks for page table retraction (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - mm/khugepaged: unify collapse pmd clear, flush and free (Rafael Aquini) [RHEL-101233] {CVE-2025-38085}
  - padata: fix UAF in padata_reorder (Waiman Long) [RHEL-101398] {CVE-2025-21727}
  - redhat: update BUILD_TARGET to rhel-8.10.0-z-test-pesign (Jan Stancek)
  - ftrace: Clean up hash direct_functions on register failures (Gregory Bell) [RHEL-103912]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.68.1.el8_10]
changelog:
  - ipv6: mcast: extend RCU protection in igmp6_send() (Hangbin Liu) [RHEL-102392] {CVE-2025-21759}
  - md/md-bitmap: move bitmap_{start, end}write to md upper layer (Nigel Croxon) [RHEL-57991]
  - md/raid5: implement pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md: add a new callback pers->bitmap_sector() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: remove the last parameter for bimtap_ops->endwrite() (Nigel Croxon) [RHEL-57991]
  - md/md-bitmap: factor behind write counters out from bitmap_{start/end}write() (Nigel Croxon) [RHEL-57991]
  - md/raid5: recheck if reshape has finished with device_lock held (Nigel Croxon) [RHEL-57991]
  - md/md-linear: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/md-multipath: enable io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid10: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - md/raid1: switch to use md_account_bio() for io accounting (Nigel Croxon) [RHEL-59928]
  - raid5: fix missing io accounting in raid5_align_endio() (Nigel Croxon) [RHEL-59928]
  - md: also clone new io if io accounting is disabled (Nigel Croxon) [RHEL-59928]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: Always pass notifications when child class becomes empty (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_deactivate() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_qfq: make qfq_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (CKI Backport Bot) [RHEL-93376] {CVE-2025-38350}
  - can: peak_usb: fix use after free bugs (CKI Backport Bot) [RHEL-99447] {CVE-2021-47670}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds (CKI Backport Bot) [RHEL-103141] {CVE-2025-38159}
  - net/ipv6: release expired exception dst cached in socket (Guillaume Nault) [RHEL-105794] {CVE-2024-56644}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.69.1.el8_10]
changelog:
  - Revert "sch_htb: make htb_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_drr: make drr_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_qfq: make qfq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog()" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_htb: make htb_deactivate() idempotent" (Denys Vlasenko) [RHEL-108140]
  - Revert "net/sched: Always pass notifications when child class becomes empty" (Denys Vlasenko) [RHEL-108140]
  - Revert "sch_cbq: make cbq_qlen_notify() idempotent" (Denys Vlasenko) [RHEL-108140]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.70.1.el8_10]
changelog:
  - i2c/designware: Fix an initialization issue (CKI Backport Bot) [RHEL-106617] {CVE-2025-38380}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() (David Marlin) [RHEL-103246] {CVE-2025-38250}
  - net_sched: ets: Fix double list add in class with netem as child qdisc (Xin Long) [RHEL-104717] {CVE-2025-37914}
  - sch_ets: make est_qlen_notify() idempotent (Xin Long) [RHEL-104717]
  - drm/vkms: Fix use after free and double free on init error (CKI Backport Bot) [RHEL-99402] {CVE-2025-22097}
  - s390/pci: Do not try re-enabling load/store if device is disabled (Mete Durlu) [RHEL-105600]
  - s390/pci: Fix stale function handles in error handling (Mete Durlu) [RHEL-105600]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.71.1.el8_10]
changelog:
  - udp: Fix memory accounting leak. (Xin Long) [RHEL-104084] {CVE-2025-22058}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw (Dennis Chen) [RHEL-106041] {CVE-2025-38200}
  - gfs2: Don't clear sb->s_fs_info in gfs2_sys_fs_add (Andrew Price) [RHEL-88072]
  - gfs2: Remove unnecessary NULL check before free_percpu() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: replace sd_aspace with sd_inode (Andreas Gruenbacher) [RHEL-88072]
  - writeback: fix false warning in inode_to_wb() (Andreas Gruenbacher) [RHEL-88072]
  - gfs2: No more self recovery (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Get rid of gfs2_glock_queue_put in signal_our_withdraw (Andreas Gruenbacher) [RHEL-104232]
  - gfs2: Fix withdraw race (Andreas Gruenbacher) [RHEL-104232]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.72.1.el8_10]
changelog:
  - scsi: lpfc: Use memcpy() for BIOS version (Ewan D. Milne) [RHEL-105927] {CVE-2025-38332}
  - watchdog/perf: properly initialize the turbo mode timestamp and rearm counter (David Arcari) [RHEL-103371]
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction (Michal Schmidt) [RHEL-104260] {CVE-2025-38211}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency (Michal Schmidt) [RHEL-104260] {CVE-2024-47696}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs (Michal Schmidt) [RHEL-104260] {CVE-2024-42285}
  - net/sched: sch_qfq: Avoid triggering might_sleep in atomic context in qfq_delete_class (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - net/sched: sch_qfq: Fix race condition on qfq_aggregate (CKI Backport Bot) [RHEL-106312] {CVE-2025-38477}
  - cxgb4: use port number to set mac addr (CKI Backport Bot) [RHEL-75976]
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist (CKI Backport Bot) [RHEL-107894]
  - aacraid: fix a buffer overflow (Tomas Henzl) [RHEL-62313]
  - filemap: remove use of wait bookmarks (Brian Foster) [RHEL-107181]
  - x86/efistub: Omit physical KASLR when memory reservations exist (Ricardo Robaina) [RHEL-82369]
  - efi/libstub: Check return value of efi_parse_options (Ricardo Robaina) [RHEL-82369]
  - efi/x86: Support builtin command line (Ricardo Robaina) [RHEL-82369]
  - tipc: Fix use-after-free in tipc_conn_close(). (CKI Backport Bot) [RHEL-106635] {CVE-2025-38464}
  - sbitmap: remove stale comment in sbq_calc_wake_batch (Ming Lei) [RHEL-81758]
  - block: Fix lockdep warning in blk_mq_mark_tag_wait (Ming Lei) [RHEL-81758]
  - blk-mq: fix potential io hang by wrong 'wake_batch' (Ming Lei) [RHEL-81758]
  - lib/sbitmap: define swap_lock as raw_spinlock_t (Ming Lei) [RHEL-81758]
  - sbitmap: fix io hung due to race on sbitmap_word::cleared (Ming Lei) [RHEL-81758]
  - sbitmap: use READ_ONCE to access map->word (Ming Lei) [RHEL-81758]
  - sbitmap: fix batching wakeup (Ming Lei) [RHEL-81758]
  - sbitmap: correct wake_batch recalculation to avoid potential IO hung (Ming Lei) [RHEL-81758]
  - sbitmap: add sbitmap_find_bit to remove repeat code in __sbitmap_get/__sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: rewrite sbitmap_find_bit_in_index to reduce repeat code (Ming Lei) [RHEL-81758]
  - sbitmap: remove redundant check in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary calculation of alloc_hint in __sbitmap_get_shallow (Ming Lei) [RHEL-81758]
  - sbitmap: Use atomic_long_try_cmpxchg in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - sbitmap: remove unnecessary code in __sbitmap_queue_get_batch (Ming Lei) [RHEL-81758]
  - lib/sbitmap: Fix invalid loop in __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - lib/sbitmap: kill 'depth' from sbitmap_word (Ming Lei) [RHEL-81758]
  - sbitmap: add __sbitmap_queue_get_batch() (Ming Lei) [RHEL-81758]
  - sbitmap: Try each queue to wake up at least one waiter (Ming Lei) [RHEL-81758]
  - wait: Return number of exclusive waiters awaken (Ming Lei) [RHEL-81758]
  - sched/wait: Deduplicate code with do-while (Ming Lei) [RHEL-81758]
  - sbitmap: Advance the queue index before waking up a queue (Ming Lei) [RHEL-81758]
  - sbitmap: Use single per-bitmap counting to wake up queued tags (Ming Lei) [RHEL-81758]
  - blk-mq: Fix wrong wakeup batch configuration which will cause hang (Ming Lei) [RHEL-81758]
  - blk-mq: fix tag_get wait task can't be awakened (Ming Lei) [RHEL-81758]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.73.1.el8_10]
changelog:
  - ACPI: resource: Honor MADT INT_SRC_OVR settings for IRQ1 on AMD Zen (Jay Shin) [RHEL-108360]
  - ACPI: resource: Always use MADT override IRQ settings for all legacy non i8042 IRQs (Jay Shin) [RHEL-108360]
  - s390/pci: Allow automatic recovery with minimal driver support (Mete Durlu) [RHEL-110234]
  - bpf: Don't use tnum_range on array range checking for poke descriptors (CKI Backport Bot) [RHEL-109298] {CVE-2022-49985}
  - s390/ism: fix concurrency management in ism_cmd() (Mete Durlu) [RHEL-110208]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.74.1.el8_10]
changelog:
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() (Oleg Nesterov) [RHEL-112775] {CVE-2025-38352}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.75.1.el8_10]
changelog:
  - Revert "module, async: async_synchronize_full() on module init iff async is used" (Herton R. Krzesinski) [RHEL-99812]
  - mm/page_alloc: make sure free_pcppages_bulk() bails when given count < 0 (Rafael Aquini) [RHEL-85453]
  - sch_cbq: make cbq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376]
  - net/sched: ets: use old 'nbands' while purging unused classes (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net_sched: sch_ets: implement lockless ets_dump() (Ivan Vecera) [RHEL-107541] {CVE-2025-38350}
  - net/sched: Always pass notifications when child class becomes empty (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - net_sched: ets: fix a race in ets_qdisc_change() (Ivan Vecera) [RHEL-107541] {CVE-2025-38107}
  - sch_htb: make htb_deactivate() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37953}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() (Ivan Vecera) [RHEL-93376] {CVE-2025-37798}
  - sch_qfq: make qfq_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_drr: make drr_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-38350}
  - sch_htb: make htb_qlen_notify() idempotent (Ivan Vecera) [RHEL-93376] {CVE-2025-37932}
  - idpf: convert control queue mutex to a spinlock (CKI Backport Bot) [RHEL-106049] {CVE-2025-38392}
  - drm/framebuffer: Acquire internal references on GEM handles (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - drm/gem: Acquire references on GEM handles for framebuffers (Anusha Srivatsa) [RHEL-106684] {CVE-2025-38449}
  - tracing: Disable interrupt or preemption before acquiring arch_spinlock_t (partial) (Luis Claudio R. Goncalves) [RHEL-95713]
  - vmxnet3: disable rx data ring on dma allocation failure (Michal Schmidt) [RHEL-106160]
  - xfs: fix error returns from xfs_bmapi_write (Carlos Maiolino) [RHEL-93655]
  - xfs: handle nimaps=0 from xfs_bmapi_write in xfs_alloc_file_space (Carlos Maiolino) [RHEL-93655]
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - net: usb: smsc75xx: Limit packet length to skb->len (CKI Backport Bot) [RHEL-112239] {CVE-2023-53125}
  - PCI: Support BAR sizes up to 8TB (Myron Stowe) [RHEL-106671]


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.76.1.el8_10]
changelog:
  - HID: core: Harden s32ton() against conversion to 0 bits (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: stop exporting hid_snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: simplify snto32() (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - HID: core: fix shift-out-of-bounds in hid_report_raw_event (CKI Backport Bot) [RHEL-111027] {CVE-2025-38556}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-107299] {CVE-2025-38498}
  - xfs: make sure sb_fdblocks is non-negative (Pavel Reichl) [RHEL-104193]
  - vsock: Fix transport_* TOCTOU (CKI Backport Bot) [RHEL-105991] {CVE-2025-38461}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.77.1.el8_10]
changelog:
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797}
  - net_sched: hfsc: Fix a UAF vulnerability in class handling (CKI Backport Bot) [RHEL-109847] {CVE-2025-37797}
  - net: openvswitch: Fix the dead loop of MPLS parse (Aaron Conole) [RHEL-95609]
  - sctp: linearize cloned gso packets in sctp_rcv (CKI Backport Bot) [RHEL-113329] {CVE-2025-38718}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-109394] {CVE-2022-50087}
  - nfsd: don't ignore the return code of svc_proc_register() (Olga Kornievskaia) [RHEL-111639] {CVE-2025-22026}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.78.1.el8_10]
changelog:
  - mm/migrate: set swap entry values of THP tail pages properly. (Luiz Capitulino) [RHEL-101302]
  - smb: client: fix use-after-free in cifs_oplock_break (Paulo Alcantara) [RHEL-111190] {CVE-2025-38527}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() (CKI Backport Bot) [RHEL-113603] {CVE-2025-39730}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.79.1.el8_10]
changelog:
  - Bluetooth: L2CAP: Fix use-after-free (CKI Backport Bot) [RHEL-116277] {CVE-2023-53305}
  - KVM: SVM: Don't BUG if userspace injects an interrupt with GIF=0 (CKI Backport Bot) [RHEL-109748] {CVE-2022-50228}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.6.1.el8_10]
changelog:
  - powerpc/powernv: Add a null pointer check in opal_event_init() (Mamatha Inamdar) [RHEL-37058] {CVE-2023-52686}
  - crypto: rsa - add a check for allocation failure (Vladis Dronov) [RHEL-35361]
  - crypto: rsa - allow only odd e and restrict value in FIPS mode (Vladis Dronov) [RHEL-35361]
  - KEYS: use kfree_sensitive with key (Vladis Dronov) [RHEL-35361]
  - lib/mpi: Extend the MPI library (only mpi_*_bit() part) (Vladis Dronov) [RHEL-35361]
  - net: ip_tunnel: prevent perpetual headroom growth (Felix Maurer) [RHEL-31814] {CVE-2024-26804}
  - s390/cpum_cf: make crypto counters upward compatible across machine types (Tobias Huschle) [RHEL-36048]
  - RDMA/mlx5: Fix fortify source warning while accessing Eth segment (Kamal Heib) [RHEL-33162] {CVE-2024-26907}
  - ovl: fix leaked dentry (Miklos Szeredi) [RHEL-27306] {CVE-2021-46972}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm/vsyscall: Consider vsyscall page part of user address space (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - x86/mm: Add vsyscall address helper (Rafael Aquini) [RHEL-33166] {CVE-2024-26906}
  - mm/swap: fix race when skipping swapcache (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - swap: fix do_swap_page() race with swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/swapfile: use percpu_ref to serialize against concurrent swapoff (Rafael Aquini) [RHEL-31644] {CVE-2024-26759}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() (Rafael Aquini) [RHEL-29294] {CVE-2023-52560}
  - ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr (Jiri Benc) [RHEL-29783]
  - block: null_blk: Fix handling of fake timeout request (Ming Lei) [RHEL-8130]
  - null_blk: fix poll request timeout handling (Ming Lei) [RHEL-8130]
  - block: null_blk: end timed out poll request (Ming Lei) [RHEL-8130]
  - block: null_blk: only set set->nr_maps as 3 if active poll_queues is > 0 (Ming Lei) [RHEL-8130]
  - null_blk: allow zero poll queues (Ming Lei) [RHEL-8130]
  - null_blk: Fix handling of submit_queues and poll_queues attributes (Ming Lei) [RHEL-8130]
  - null_blk: poll queue support (Ming Lei) [RHEL-8130]
  - null_blk: fix command timeout completion handling (Ming Lei) [RHEL-8130]
  - platform/x86: dell-smbios-wmi: Fix oops on rmmod dell_smbios (Prarit Bhargava) [RHEL-27790] {CVE-2021-47073}
  - Bluetooth: avoid memcmp() out of bounds warning (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix coding style (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Fix using memcmp when comparing keys (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: Reject connection with the device which has same BD_ADDR (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - Bluetooth: hci_event: Ignore NULL link key (David Marlin) [RHEL-3017] {CVE-2020-26555}
  - ppp_async: limit MRU to 64K (Guillaume Nault) [RHEL-31353] {CVE-2024-26675}
  - powerpc/imc-pmu: Add a null pointer check in update_events_in_group() (Mamatha Inamdar) [RHEL-37078] {CVE-2023-52675}
  - tcp: do not accept ACK of bytes we never sent (Xin Long) [RHEL-21952]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.80.1.el8_10]
changelog:
  - block: remove some blk_mq_hw_ctx debugfs entries (Ricardo Robaina) [RHEL-8816]
  - blk-mq: Remove the hctx 'run' debugfs attribute (Ricardo Robaina) [RHEL-8816]
  - block: remove debugfs blk_mq_ctx dispatched/merged/completed attributes (Ricardo Robaina) [RHEL-8816]
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control (CKI Backport Bot) [RHEL-114840] {CVE-2025-39751}
  - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117228] {CVE-2023-53373}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too (Jaroslav Kysela) [RHEL-114681] {CVE-2025-38729}
  - ALSA: usb-audio: Fix size validation in convert_chmap_v3() (Jaroslav Kysela) [RHEL-114681]
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors (Jaroslav Kysela) [RHEL-114681] {CVE-2025-39757}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.81.1.el8_10]
changelog:
  - Bluetooth: L2CAP: Fix user-after-free (CKI Backport Bot) [RHEL-117369] {CVE-2022-50386}
  - Bluetooth: Fix potential use-after-free when clear keys (CKI Backport Bot) [RHEL-117193] {CVE-2023-53386}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-117924] {CVE-2025-39817}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-117707] {CVE-2025-39841}
  - mm, meminit: recalculate pcpu batch and high limits after init completes (Audra Mitchell) [RHEL-108920]
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp (CKI Backport Bot) [RHEL-118478] {CVE-2023-53297}
  - net/mlx5: Stop waiting for PCI if pci channel is offline (CKI Backport Bot) [RHEL-114111]
  - mm/shmem: fix potential dead loop in shmem_unuse() (Rafael Aquini) [RHEL-104909]
  - mm/gup: fix wrongly calculated returned value in fault_in_safe_writeable() (Rafael Aquini) [RHEL-104909]
  - mm: fix apply_to_existing_page_range() (Rafael Aquini) [RHEL-104909]
  - arm64: mm: Correct the update of max_pfn (Rafael Aquini) [RHEL-104909]
  - mm, percpu: do not consider sleepable allocations atomic (Rafael Aquini) [RHEL-104909]
  - mm/hugetlb: wait for hugetlb folios to be freed (Rafael Aquini) [RHEL-104909]
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs (Rafael Aquini) [RHEL-104909]
  - x86/mm/pat: cpa-test: fix length for CPA_ARRAY test (Rafael Aquini) [RHEL-104909]
  - arm64: Fix KASAN random tag seed initialization (Rafael Aquini) [RHEL-104909]
  - mm/numa_balancing: teach mpol_to_str about the balancing mode (Rafael Aquini) [RHEL-104909]
  - s390/mm: Fix clearing storage keys for huge pages (Rafael Aquini) [RHEL-104909]
  - s390/mm: Fix storage key clearing for guest huge pages (Rafael Aquini) [RHEL-104909]
  - mm/slub, kunit: Use inverted data to corrupt kmem cache (Rafael Aquini) [RHEL-104909]
  - mm: memcg: use larger batches for proactive reclaim (Rafael Aquini) [RHEL-104909]
  - mm: memcg: don't periodically flush stats when memcg is disabled (Rafael Aquini) [RHEL-104909]
  - mm: writeback: ratelimit stat flush from mem_cgroup_wb_stats (Rafael Aquini) [RHEL-104909]
  - mm: memcontrol: don't throttle dying tasks on memory.high (Rafael Aquini) [RHEL-104909]
  - arm64: mm: Always make sw-dirty PTEs hw-dirty in pte_modify (Rafael Aquini) [RHEL-104909]
  - arm64/mm: Set only the PTE_DIRTY bit while preserving the HW dirty state (Rafael Aquini) [RHEL-104909]
  - base/node.c: initialize the accessor list before registering (Rafael Aquini) [RHEL-104909]
  - mm: hugetlb: eliminate memory-less nodes handling (Rafael Aquini) [RHEL-104909]
  - mm: hugetlb: simplify per-node sysfs creation and removal (Rafael Aquini) [RHEL-104909]
  - powerpc/pseries: fix potential memory leak in init_cpu_associativity() (Rafael Aquini) [RHEL-104909]
  - writeback, cgroup: switch inodes with dirty timestamps to release dying cgwbs (Rafael Aquini) [RHEL-104909]
  - vfs: fix readahead(2) on block devices (Rafael Aquini) [RHEL-104909]
  - mm/page_alloc: correct start page when guard page debug is enabled (Rafael Aquini) [RHEL-104909]
  - mm/memory_hotplug: use pfn math in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909]
  - mm/cma: use nth_page() in place of direct struct page manipulation (Rafael Aquini) [RHEL-104909]
  - slab: kmalloc_size_roundup() must not return 0 for non-zero size (Rafael Aquini) [RHEL-104909]
  - mm: memcontrol: fix GFP_NOFS recursion in memory.high enforcement (Rafael Aquini) [RHEL-104909]
  - mm/vmalloc: add a safer version of find_vm_area() for debug (Rafael Aquini) [RHEL-104909]
  - mm/vmalloc: extend __find_vmap_area() with one more argument (Rafael Aquini) [RHEL-104909]
  - mm: memory-failure: fix unexpected return value in soft_offline_page() (Rafael Aquini) [RHEL-104909]
  - mm: memory-failure: kill soft_offline_free_page() (Rafael Aquini) [RHEL-104909]
  - radix tree: remove unused variable (Rafael Aquini) [RHEL-104909]
  - mm: add a call to flush_cache_vmap() in vmap_pfn() (Rafael Aquini) [RHEL-104909]
  - tmpfs: verify {g,u}id mount options correctly (Rafael Aquini) [RHEL-104909]
  - powerpc/mm/altmap: Fix altmap boundary check (Rafael Aquini) [RHEL-104909]
  - powerpc/mm/dax: Fix the condition when checking if altmap vmemap can cross-boundary (Rafael Aquini) [RHEL-104909]
  - writeback: fix dereferencing NULL mapping->host on writeback_page_template (Rafael Aquini) [RHEL-104909]
  - x86/mm: Avoid using set_pgd() outside of real PGD pages (Rafael Aquini) [RHEL-104909]
  - mm: vmalloc must set pte via arch code (Rafael Aquini) [RHEL-104909]
  - mm: zswap: shrink until can accept (Rafael Aquini) [RHEL-104909]
  - mm, compaction: finish pageblocks on complete migration failure (Rafael Aquini) [RHEL-104909]
  - mm, compaction: finish scanning the current pageblock if requested (Rafael Aquini) [RHEL-104909]
  - mm, compaction: check if a page has been captured before draining PCP pages (Rafael Aquini) [RHEL-104909]
  - mm, compaction: rename compact_control->rescan to finish_pageblock (Rafael Aquini) [RHEL-104909]
  - mm/compaction: move compaction_suitable's comment to right place (Rafael Aquini) [RHEL-104909]
  - mm/compaction: rename 'start_pfn' to 'iteration_start_pfn' in compact_zone() (Rafael Aquini) [RHEL-104909]
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() (Rafael Aquini) [RHEL-104909]
  - Revert "mm/compaction: fix set skip in fast_find_migrateblock" (Rafael Aquini) [RHEL-104909]
  - mm/page_reporting: replace rcu_access_pointer() with rcu_dereference_protected() (Rafael Aquini) [RHEL-104909]
  - mm/compaction: fix set skip in fast_find_migrateblock (Rafael Aquini) [RHEL-104909]
  - memregion: Fix memregion_free() fallback definition (Rafael Aquini) [RHEL-104909]
  - s390/extable: fix exception table sorting (Rafael Aquini) [RHEL-104909]
  - shmem: shmem_writepage() split unlikely i915 THP (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: decide stat.st_blksize by shmem_is_huge() (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: shmem_is_huge(vma, inode, index) (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: SGP_NOALLOC to stop collapse_file() on race (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: move shmem_huge_enabled() upwards (Rafael Aquini) [RHEL-104909]
  - huge tmpfs: remove shrinklist addition from shmem_setattr() (Rafael Aquini) [RHEL-104909]
  - mm,shmem,thp: limit shmem THP allocations to requested zones (Rafael Aquini) [RHEL-104909]
  - mm,thp,shm: limit gfp mask to no more than specified (Rafael Aquini) [RHEL-104909]
  - mm,thp,shmem: limit shmem THP alloc gfp_mask (Rafael Aquini) [RHEL-104909]
  - mm/swap: optimise get_shadow_from_swap_cache (Rafael Aquini) [RHEL-104909]
  - mm/shmem: use pagevec_lookup in shmem_unlock_mapping (Rafael Aquini) [RHEL-104909]
  - mm: make pagecache tagged lookups return only head pages (Rafael Aquini) [RHEL-104909]
  - mm: fix madvise WILLNEED performance problem (Rafael Aquini) [RHEL-104909]
  - mm: pagemap.h: fix two kernel-doc markups (Rafael Aquini) [RHEL-104909]
  - mm: add find_lock_head (Rafael Aquini) [RHEL-104909]
  - mm/shmem: return head page from find_lock_entry (Rafael Aquini) [RHEL-104909]
  - mm: convert find_get_entry to return the head page (Rafael Aquini) [RHEL-104909]
  - i915: use find_lock_page instead of find_lock_entry (Rafael Aquini) [RHEL-104909]
  - proc: optimise smaps for shmem entries (Rafael Aquini) [RHEL-104909]
  - mm: optimise madvise WILLNEED (Rafael Aquini) [RHEL-104909]
  - mm: use find_get_incore_page in memcontrol (Rafael Aquini) [RHEL-104909]
  - mm: factor find_get_incore_page out of mincore_page (Rafael Aquini) [RHEL-104909]
  - mm/shmem: fix build without THP (Rafael Aquini) [RHEL-104909]
  - mm: huge tmpfs: try to split_huge_page() when punching hole (Rafael Aquini) [RHEL-104909]
  - mm/shmem.c: clean code by removing unnecessary assignment (Rafael Aquini) [RHEL-104909]
  - mm/shmem.c: distribute switch variables for initialization (Rafael Aquini) [RHEL-104909]
  - include/linux/pagemap.h: optimise find_subpage for !THP (Rafael Aquini) [RHEL-104909]
  - mm/filemap.c: unexport find_get_entry (Rafael Aquini) [RHEL-104909]
  - include/linux/pagemap.h: rename arguments to find_subpage (Rafael Aquini) [RHEL-104909]
  - powerpc/mm: drop #ifdef CONFIG_MMU in is_ioremap_addr() (Rafael Aquini) [RHEL-104909]
  - powerpc: remove the __kernel_io_end export (Rafael Aquini) [RHEL-104909]
  - mm/shmem: make find_get_pages_range() work for huge page (Rafael Aquini) [RHEL-104909]
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117577] {CVE-2025-39849}
  - dlm: move to rinfo for all middle conversion cases (Alexander Aring) [RHEL-110032]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.82.1.el8_10]
changelog:
  - smb: client: fix missing timestamp updates after utime(2) (Paulo Alcantara) [RHEL-109431]
  - cifs: fix leak of iface for primary channel (Paulo Alcantara) [RHEL-109546]
  - cifs: reset iface weights when we cannot find a candidate (Paulo Alcantara) [RHEL-109546]
  - cifs: deal with the channel loading lag while picking channels (Paulo Alcantara) [RHEL-109546]
  - smb3: missing lock when picking channel (Paulo Alcantara) [RHEL-109546] {CVE-2024-35999}
  - smb: client: fix potential deadlock when reconnecting channels (Paulo Alcantara) [RHEL-109546] {CVE-2025-38244}
  - cifs: update dstaddr whenever channel iface is updated (Paulo Alcantara) [RHEL-109546]
  - smb: client: fix oops due to unset link speed (Paulo Alcantara) [RHEL-109546] {CVE-2025-21725}
  - smb: client: fix use-after-free of signing key (Paulo Alcantara) [RHEL-109546] {CVE-2024-53179}
  - smb: client: fix UAF in smb2_reconnect_server() (Paulo Alcantara) [RHEL-109546] {CVE-2024-35870}
  - cifs: failure to add channel on iface should bump up weight (Paulo Alcantara) [RHEL-109546]
  - cifs: update iface_last_update on each query-and-update (Paulo Alcantara) [RHEL-109546]
  - cifs: do not depend on release_iface for maintaining iface_list (Paulo Alcantara) [RHEL-109546]
  - cifs: cifs_chan_is_iface_active should be called with chan_lock held (Paulo Alcantara) [RHEL-109546]
  - cifs: account for primary channel in the interface list (Paulo Alcantara) [RHEL-109546]
  - cifs: distribute channels across interfaces based on speed (Paulo Alcantara) [RHEL-109546]
  - cifs: handle cases where a channel is closed (Paulo Alcantara) [RHEL-109546]
  - cifs: force interface update before a fresh session setup (Paulo Alcantara) [RHEL-109546]
  - cifs: do not reset chan_max if multichannel is not supported at mount (Paulo Alcantara) [RHEL-109546]
  - cifs: reconnect helper should set reconnect for the right channel (Paulo Alcantara) [RHEL-109546]
  - smb: client: fix use-after-free bug in cifs_debug_data_proc_show() (Paulo Alcantara) [RHEL-109546] {CVE-2023-52752}
  - cifs: print last update time for interface list (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state transition to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546]
  - cifs: log session id when a matching ses is not found (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state check in smb2_find_smb_ses (Paulo Alcantara) [RHEL-109546]
  - cifs: fix session state check in reconnect to avoid use-after-free issue (Paulo Alcantara) [RHEL-109546]
  - cifs: do all necessary checks for credits within or before locking (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname (Paulo Alcantara) [RHEL-109546]
  - cifs: print smb3_fs_context::source when mounting (Paulo Alcantara) [RHEL-109546]
  - cifs: protect session status check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: missing lock when updating session status (Paulo Alcantara) [RHEL-109546]
  - cifs: refcount only the selected iface during interface update (Paulo Alcantara) [RHEL-109546]
  - cifs: double lock in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546]
  - cifs: get rid of dead check in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid races in parallel reconnects in smb1 (Paulo Alcantara) [RHEL-109546]
  - cifs: fix missing unload_nls() in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid race conditions with parallel reconnects (Paulo Alcantara) [RHEL-109546]
  - cifs: empty interface list when server doesn't support query interfaces (Paulo Alcantara) [RHEL-109546]
  - cifs: do not poll server interfaces too regularly (Paulo Alcantara) [RHEL-109546]
  - cifs: generate signkey for the channel that's reconnecting (Paulo Alcantara) [RHEL-109546]
  - cifs: Move the in_send statistic to __smb_send_rqst() (Paulo Alcantara) [RHEL-109546]
  - cifs: prevent data race in cifs_reconnect_tcon() (Paulo Alcantara) [RHEL-109546]
  - cifs: reuse cifs_match_ipaddr for comparison of dstaddr too (Paulo Alcantara) [RHEL-109546]
  - cifs: match even the scope id for ipv6 addresses (Paulo Alcantara) [RHEL-109546]
  - cifs: update ip_addr for ses only for primary chan setup (Paulo Alcantara) [RHEL-109546]
  - cifs: use tcon allocation functions even for dummy tcon (Paulo Alcantara) [RHEL-109546]
  - cifs: use the least loaded channel for sending requests (Paulo Alcantara) [RHEL-109546]
  - cifs: get rid of dns resolve worker (Paulo Alcantara) [RHEL-109546]
  - cifs: prevent data race in smb2_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: do not query ifaces on smb1 mounts (Paulo Alcantara) [RHEL-109546]
  - cifs: fix interface count calculation during refresh (Paulo Alcantara) [RHEL-109546]
  - cifs: protect access of TCP_Server_Info::{dstaddr,hostname} (Paulo Alcantara) [RHEL-109546]
  - cifs: fix race in assemble_neg_contexts() (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct status of tcon ipc when reconnecting (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct ipc status after initial tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: set correct tcon status after initial tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: Use after free in debug code (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid unnecessary iteration of tcp sessions (Paulo Alcantara) [RHEL-109546]
  - smb3: interface count displayed incorrectly (Paulo Alcantara) [RHEL-109546]
  - cifs: Fix xid leak in cifs_ses_add_channel() (Paulo Alcantara) [RHEL-109546]
  - smb3: clarify multichannel warning (Paulo Alcantara) [RHEL-109546]
  - smb3: do not log confusing message when server returns no network interfaces (Paulo Alcantara) [RHEL-109546]
  - cifs: return correct error in ->calc_signature() (Paulo Alcantara) [RHEL-109546]
  - cifs: add missing spinlock around tcon refcount (Paulo Alcantara) [RHEL-109546]
  - cifs: fix small mempool leak in SMB2_negotiate() (Paulo Alcantara) [RHEL-109546] {CVE-2022-49938}
  - cifs: remove useless parameter 'is_fsctl' from SMB2_ioctl() (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unused server parameter from calc_smb_size() (Paulo Alcantara) [RHEL-109546]
  - smb3: limit noisy error (Paulo Alcantara) [RHEL-109546]
  - cifs: alloc_mid function should be marked as static (Paulo Alcantara) [RHEL-109546]
  - cifs: remove "cifs_" prefix from init/destroy mids functions (Paulo Alcantara) [RHEL-109546]
  - cifs: fix wrong unlock before return from cifs_tree_connect() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid use of global locks for high contention data (Paulo Alcantara) [RHEL-109546]
  - cifs: remove remaining build warnings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove minor build warning (Paulo Alcantara) [RHEL-109546]
  - cifs: remove some camelCase and also some static build warnings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary (void*) conversions. (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary type castings (Paulo Alcantara) [RHEL-109546]
  - cifs: remove redundant initialization to variable mnt_sign_enabled (Paulo Alcantara) [RHEL-109546]
  - smb3: check xattr value length earlier (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unnecessary locking of chan_lock while freeing session (Paulo Alcantara) [RHEL-109546]
  - cifs: fix race condition with delayed threads (Paulo Alcantara) [RHEL-109546]
  - cifs: update cifs_ses::ip_addr after failover (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid deadlocks while updating iface (Paulo Alcantara) [RHEL-109546]
  - cifs: periodically query network interfaces from server (Paulo Alcantara) [RHEL-109546]
  - cifs: during reconnect, update interface if necessary (Paulo Alcantara) [RHEL-109546]
  - cifs: change iface_list from array to sorted linked list (Paulo Alcantara) [RHEL-109546]
  - cifs: when a channel is not found for server, log its connection id (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential deadlock in direct reclaim (Paulo Alcantara) [RHEL-109546]
  - cifs: return errors during session setup during reconnects (Paulo Alcantara) [RHEL-109546]
  - cifs: remove repeated debug message on cifs_put_smb_ses() (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid parallel session setups on same channel (Paulo Alcantara) [RHEL-109546]
  - cifs: use new enum for ses_status (Paulo Alcantara) [RHEL-109546]
  - cifs: fix incorrect use of list iterator after the loop (Paulo Alcantara) [RHEL-109546]
  - cifs: do not use tcpStatus after negotiate completes (Paulo Alcantara) [RHEL-109546]
  - cifs: use correct lock type in cifs_reconnect() (Paulo Alcantara) [RHEL-109546]
  - cifs: Use kzalloc instead of kmalloc/memset (Paulo Alcantara) [RHEL-109546]
  - cifs: force new session setup and tcon for dfs (Paulo Alcantara) [RHEL-109546]
  - cifs: fix potential race with cifsd thread (Paulo Alcantara) [RHEL-109546]
  - smb3: cleanup and clarify status of tree connections (Paulo Alcantara) [RHEL-109546]
  - cifs: use a different reconnect helper for non-cifsd threads (Paulo Alcantara) [RHEL-109546]
  - smb3: fix incorrect session setup check for multiuser mounts (Paulo Alcantara) [RHEL-109546]
  - cifs: mark sessions for reconnection in helper function (Paulo Alcantara) [RHEL-109546]
  - cifs: call helper functions for marking channels for reconnect (Paulo Alcantara) [RHEL-109546]
  - cifs: call cifs_reconnect when a connection is marked (Paulo Alcantara) [RHEL-109546]
  - cifs: unlock chan_lock before calling cifs_put_tcp_session (Paulo Alcantara) [RHEL-109546]
  - cifs: cifs_ses_mark_for_reconnect should also update reconnect bits (Paulo Alcantara) [RHEL-109546]
  - cifs: update tcpStatus during negotiate and sess setup (Paulo Alcantara) [RHEL-109546]
  - cifs: make status checks in version independent callers (Paulo Alcantara) [RHEL-109546]
  - cifs: remove repeated state change in dfs tree connect (Paulo Alcantara) [RHEL-109546]
  - cifs: fix the cifs_reconnect path for DFS (Paulo Alcantara) [RHEL-109546]
  - cifs: remove unused variable ses_selected (Paulo Alcantara) [RHEL-109546]
  - cifs: protect all accesses to chan_* with chan_lock (Paulo Alcantara) [RHEL-109546]
  - cifs: fix the connection state transitions with multichannel (Paulo Alcantara) [RHEL-109546]
  - cifs: check reconnects for channels of active tcons too (Paulo Alcantara) [RHEL-109546]
  - cifs: avoid race during socket reconnect between send and recv (Paulo Alcantara) [RHEL-109546]
  - cifs: maintain a state machine for tcp/smb/tcon sessions (Paulo Alcantara) [RHEL-109546]
  - cifs: fix hang on cifs_get_next_mid() (Paulo Alcantara) [RHEL-109546]
  - cifs: take cifs_tcp_ses_lock for status checks (Paulo Alcantara) [RHEL-109546]
  - cifs: reconnect only the connection and not smb session where possible (Paulo Alcantara) [RHEL-109546]
  - cifs: add WARN_ON for when chan_count goes below minimum (Paulo Alcantara) [RHEL-109546]
  - cifs: adjust DebugData to use chans_need_reconnect for conn status (Paulo Alcantara) [RHEL-109546]
  - cifs: use the chans_need_reconnect bitmap for reconnect status (Paulo Alcantara) [RHEL-109546]
  - cifs: track individual channel status using chans_need_reconnect (Paulo Alcantara) [RHEL-109546]
  - cifs: Adjust key sizes and key generation routines for AES256 encryption (Paulo Alcantara) [RHEL-109546]
  - cifs: fix allocation size on newly created files (Paulo Alcantara) [RHEL-109546]
  - veth: try harder when allocating queue memory (Davide Caratti) [RHEL-92515]
  - net: enable memcg accounting for veth queues (Davide Caratti) [RHEL-92515]
  - gfs2: No more gfs2_find_jhead caching (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Clean up revokes on normal withdraws (Bob Peterson) [RHEL-92461]
  - gfs2: Get rid of duplicate log head lookup (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Improve gfs2_make_fs_rw error handling (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Simplify clean_journal (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Simplify gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461]
  - gfs2: Fix glock recursion in freeze_go_xmote_bh (Bob Peterson) [RHEL-92461]
  - gfs2: Move gfs2_log_pointers_init (Andreas Gruenbacher) [RHEL-92461]
  - mm: hugetlb: conditionally disable tlb_remove_table_sync_one() in huge_pmd_unshare() (Rafael Aquini) [RHEL-120391]
  - kernel: extend rh_waived to cope better with the CVE mitigations case (Rafael Aquini) [RHEL-120391]
  - Add support to rh_waived cmdline boot parameter (Rafael Aquini) [RHEL-120391]
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-117792] {CVE-2025-39864}
  - ext4: prevent stale extent cache entries caused by concurrent I/O writeback (Brian Foster) [RHEL-50745]
  - ext4: ext4: unify EXT4_EX_NOCACHE|NOFAIL flags in ext4_ext_remove_space() (Brian Foster) [RHEL-50745]
  - ext4: check the extent status again before inserting delalloc block (Brian Foster) [RHEL-50745]
  - ext4: factor out a common helper to query extent map (Brian Foster) [RHEL-50745]
  - ext4: convert to exclusive lock while inserting delalloc extents (Brian Foster) [RHEL-50745]
  - ext4: refactor ext4_da_map_blocks() (Brian Foster) [RHEL-50745]
  - wifi: mac80211: check S1G action frame size (Jose Ignacio Tornos Martinez) [RHEL-116069] {CVE-2023-53257}
  - wifi: mwifiex: Fix oob check condition in mwifiex_process_rx_packet (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}
  - wifi: mwifiex: Fix missed return in oob checks failed path (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}
  - wifi: mwifiex: Fix OOB and integer underflow when rx packets (Jose Ignacio Tornos Martinez) [RHEL-115516] {CVE-2023-53226}


author: Denys Vlasenko <dvlasenk@redhat.com> [4.18.0-553.83.1.el8_10]
changelog:
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (Abhi Das) [RHEL-116658] {CVE-2022-50367}
  - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86_64 (Waiman Long) [RHEL-114285]
  - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114285] {CVE-2025-40300}
  - i40e: fix Jumbo Frame support after iPXE boot (Mohammad Heib) [RHEL-121781]
  - i40e: Report MFS in decimal base instead of hex (Mohammad Heib) [RHEL-121781]
  - i40e: Fix unexpected MFS warning message (Mohammad Heib) [RHEL-121781]
  - bitfield: Add FIELD_MODIFY() helper (Mohammad Heib) [RHEL-121781]
  - bitops: Add non-atomic bitops for pointers (Mohammad Heib) [RHEL-121781]
  - qed/qede: Fix scheduling while atomic (CKI Backport Bot) [RHEL-9757]
  - fanotify: add watchdog for permission events (Miklos Szeredi) [RHEL-123215]
  - jiffies: Cast to unsigned long in secs_to_jiffies() conversion (Miklos Szeredi) [RHEL-123215]
  - jiffies: Define secs_to_jiffies() (Miklos Szeredi) [RHEL-123215]
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-105611]
  - mm: zswap: fix missing folio cleanup in writeback race path (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178}
  - mm: fix zswap writeback race condition (Aristeu Rozanski) [RHEL-116239] {CVE-2023-53178}


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.84.1.el8_10]
changelog:
  - cgroup: don't put ERR_PTR() into fc->root (CKI Backport Bot) [RHEL-123775]
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114296] {CVE-2025-39718}
  - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-123005]


author: Alexandra Hájková <ahajkova@redhat.com> [4.18.0-553.85.1.el8_10]
changelog:
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123799]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123799] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123799] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123799] {CVE-2025-39970}
  - i40e: Fix filter input checks to prevent config with invalid values (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123799] {CVE-2025-39971}
  - i40e: fix: remove needless retries of NVM update (Michal Schmidt) [RHEL-123799]
  - i40e: remove i40e_status (Michal Schmidt) [RHEL-123799]
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123799] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123799] {CVE-2025-39973}
  - i40e: increase max descriptors for XL710 (Michal Schmidt) [RHEL-123799]
  - drm/nouveau: Don't create connectors that aren't in disp.conn_mask (Lyude Paul) [RHEL-22122]
  - NFS: Fix a race when updating an existing write (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests (Olga Kornievskaia) [RHEL-113849] {CVE-2025-39697}
  - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.86.1.el8_10]
changelog:
  - smb: client: fix race with concurrent opens in rename(2) (Paulo Alcantara) [RHEL-118237] {CVE-2025-39825}
  - smb: client: fix race with concurrent opens in unlink(2) (Paulo Alcantara) [RHEL-118237]
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123105] {CVE-2025-39898}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125595] {CVE-2025-38724}
  - nbd: fix incomplete validation of ioctl arg (CKI Backport Bot) [RHEL-122965] {CVE-2023-53513}
  - arch/powerpc: commandline option to enable P11 support (Mamatha Inamdar) [RHEL-107921]
  - perf/pmu-events/powerpc: Update json mapfile with Power11 PVR (Mamatha Inamdar) [RHEL-107921]
  - perf vendor events powerpc: Add PVN for HX-C2000 CPU with Power8 Architecture (Mamatha Inamdar) [RHEL-107921]
  - tools/perf/arch/powerpc: Fix the CPU ID const char* value by adding 0x prefix (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Power11 Performance Monitoring support (Mamatha Inamdar) [RHEL-107921]
  - powerpc/perf: Add __init attribute to eligible functions (Mamatha Inamdar) [RHEL-107921]
  - powerpc: Add Power11 architected and raw mode (Mamatha Inamdar) [RHEL-107921]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.87.1.el8_10]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120664]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120664] {CVE-2025-39955}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (Audra Mitchell) [RHEL-117059] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.88.1.el8_10]
changelog:
  - scsi: s390: zfcp: Ensure synchronous unit_add (Mete Durlu) [RHEL-129199]
  - RDMA/rxe: Fix incomplete state save in rxe_requester (Kamal Heib) [RHEL-124700] {CVE-2023-53539}
  - RDMA/rxe: Fix mr->map double free (CKI Backport Bot) [RHEL-123715] {CVE-2022-50543}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.89.1.el8_10]
changelog:
  - mm: memcg: use READ_ONCE()/WRITE_ONCE() to access stock->cached (Radostin Stoyanov) [RHEL-122774]
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - mm/memcg: revert ("mm/memcg: optimize user context object stock access") (Radostin Stoyanov) [RHEL-122774] {CVE-2023-53401}
  - gfs2: Add proper lockspace locking (Andreas Gruenbacher) [RHEL-88660]
  - gfs2: do_xmote cleanup (Andreas Gruenbacher) [RHEL-88660]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.91.1.el8_10]
changelog:
  - gfs2: Do not cancel internal demote requests (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: run_queue cleanup (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: simplify finish_xmote (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Get rid of unnecessary test_and_set_bit (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Retries missing in gfs2_{rename,exchange} (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: glock cancelation flag fix (Andreas Gruenbacher) [RHEL-135355]
  - gfs2: Minor do_xmote cancelation fix (Andreas Gruenbacher) [RHEL-135355]
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-133999] {CVE-2025-40240}
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)
  - cifs: fix automount with passwords that contain commas (Paulo Alcantara) [RHEL-125963]
  - perf/x86/intel/ds: Fix the conversion from TSC to perf time (Anubhav Shelat) [RHEL-127171]
  - perf/x86/intel/pebs: Fix PEBS timestamps overwritten (Anubhav Shelat) [RHEL-127171]
  - ceph: fix client race condition where r_parent becomes stale before sending message (Alex Markuze) [RHEL-120226]
  - ceph: fix client race condition validating r_parent before applying state (Alex Markuze) [RHEL-120226]
  - blk-mq: setup queue ->tag_set before initializing hctx (Ming Lei) [RHEL-30744]
  - blk-mq: add helper for checking if one CPU is mapped to specified hctx (Ming Lei) [RHEL-30744]
  - blk-mq: don't schedule block kworker on isolated CPUs (Ming Lei) [RHEL-30744]
  - sched/isolation: add cpu_is_isolated() API (Ming Lei) [RHEL-30744]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.92.1.el8_10]
changelog:
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137395] {CVE-2025-68285}
  - media: rc: fix races with imon_disconnect() (Kate Hsuan) [RHEL-124396] {CVE-2025-39993}
  - media: imon: fix a race condition in send_packet() (Kate Hsuan) [RHEL-124396]
  - media: imon: reorganize serialization (Kate Hsuan) [RHEL-124396]
  - media: imon: drop references only after device is no longer used (Kate Hsuan) [RHEL-124396]
  - media: rc: Add support for another iMON 0xffdc device (Kate Hsuan) [RHEL-124396]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.93.1.el8_10]
changelog:
  - mm: compaction: update the COMPACT[STALL|FAIL] events properly (Lucas Oakley) [RHEL-132449]
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125456] {CVE-2025-40096}
  - drm/i915: mark requests for GuC virtual engines to avoid use-after-free (CKI Backport Bot) [RHEL-124682] {CVE-2023-53552}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [4.18.0-553.94.1.el8_10]
changelog:
  - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139482] {CVE-2025-68301}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131387] {CVE-2025-39933}
  - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134369] {CVE-2025-38051}


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> [4.18.0-553.94.1.lve.1.el8_10]
changelog:
  - CLKRN-2034 netfilter: ipset: add rcu_barrier to mtype_cancel_gc for hash types
  - CLKRN-2034 netfilter: ipset: fix region locking in hash types


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els35]
changelog:
  - ptrace: require CAP_SYS_PTRACE when task has no mm
  - net: udp_offload: propagate SKBFL_SHARED_FRAG in skb_gro_receive_list {CVE-2026-46300}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() {CVE-2026-31532}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els1]
changelog:
  - perf/x86/intel/uncore: Fix die ID init and look up bugs {CVE-2026-43344}
  - x86/apic: Disable x2apic on resume if the kernel expects so {CVE-2026-43363}
  - drm/amdgpu: Fix use-after-free race in VM acquire {CVE-2026-43370}
  - dm: remove fake timeout to avoid leak request {CVE-2026-43314}
  - md/bitmap: fix GPF in write_page caused by resize race {CVE-2026-43163}
  - drm: Account property blob allocations to memcg {CVE-2026-43287}
  - drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() {CVE-2026-43206}
  - Bluetooth: btintel: serialize btintel_hw_error() with hci_req_sync_lock {CVE-2026-31500}
  - net/sched: Fix backlog accounting in qdisc_dequeue_internal {CVE-2025-39677}
  - l2tp: avoid one data-race in l2tp_tunnel_del_work() {CVE-2026-23120}
  - net: fec: Fix possible NPD in fec_enet_phy_reset_after_clk_enable() {CVE-2025-39876}
  - espintcp: fix skb leaks {CVE-2025-38057}
  - cpufreq: scpi: Fix null-ptr-deref in scpi_cpufreq_get_rate() {CVE-2025-37829}
  - tipc: fix NULL pointer dereference in tipc_mon_reinit_self() {CVE-2025-37824}
  - KVM: x86: Acquire SRCU in KVM_GET_MP_STATE to protect guest memory accesses {CVE-2025-23141}
  - virtiofs: add filesystem context source name check {CVE-2025-37773}
  - netlabel: Fix NULL pointer exception caused by CALIPSO on IPv4 sockets {CVE-2025-22063}
  - ppp: Fix KMSAN uninit-value warning with bpf {CVE-2025-21922}
  - wifi: cfg80211: regulatory: improve invalid hints checking {CVE-2025-21910}
  - wifi: ath11k: fix RCU stall while reaping monitor destination ring {CVE-2024-58097}
  - net/sctp: Prevent autoclose integer overflow in sctp_association_init() {CVE-2024-57938}
  - ubi: fastmap: Fix duplicate slab cache names while attaching {CVE-2024-53172}
  - drm/modes: Avoid divide by zero harder in drm_mode_vrefresh() {CVE-2024-56369}
  - firmware: arm_scpi: Check the DVFS OPP count returned by the firmware {CVE-2024-53157}
  - vsock: Fix sk_error_queue memory leak {CVE-2024-53118}
  - mm: fix NULL pointer dereference in alloc_pages_bulk_noprof {CVE-2024-53113}
  - exec: don't WARN for racy path_noexec check {CVE-2024-50010}
  - drm/amd/display: Initialize get_bytes_per_element's default to 1 {CVE-2024-49892}
  - ppp: do not assume bh is held in ppp_channel_bridge_input() {CVE-2024-49946}
  - drm/amd/display: Skip Recompute DSC Params if no Stream on Link {CVE-2024-47683}
  - x86/sgx: Fix deadlock in SGX NUMA node search {CVE-2024-49856}
  - pktgen: use cpus_read_lock() in pg_net_init() {CVE-2024-46681}
  - nfsd: call cache_put if xdr_reserve_space returns NULL {CVE-2024-47737}
  - uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
  - drm/amd/display: Skip inactive planes within ModeSupportAndSystemConfiguration {CVE-2024-46812}
  - net/mlx5: Fix bridge mode operations when there are no VFs {CVE-2024-46857}
  - Input: MT - limit max slots {CVE-2024-45008}
  - net/mlx5e: SHAMPO, Fix incorrect page release {CVE-2024-46717}
  - netfilter: ctnetlink: use helper function to calculate expect ID {CVE-2024-44944}
  - lib: objagg: Fix general protection fault {CVE-2024-43846}
  - drm/qxl: Add check for drm_cvt_mode {CVE-2024-43829}
  - mlxsw: spectrum_buffers: Fix memory corruptions on Spectrum-4 systems {CVE-2024-42073}
  - drm/nouveau: fix null pointer dereference in nouveau_connector_get_modes {CVE-2024-42101}
  - RDMA/mlx5: Add check for srq max_sge attribute {CVE-2024-40990}
  - tracing: Build event generation tests only as modules {CVE-2024-41004}
  - KEYS: trusted: Fix memory leak in tpm2_key_encode() {CVE-2024-36967}
  - epoll: be better about file lifetimes {CVE-2024-38580}
  - drm/radeon: fix UBSAN warning in kv_dpm.c {CVE-2024-40988}
  - RDMA/srpt: Add a check for valid 'mad_agent' pointer {CVE-2023-54274}
  - x86/hyperv: Disable IBT when hypercall page lacks ENDBR instruction {CVE-2023-54172}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_find_by_goal() {CVE-2024-26772}
  - iommu/vt-d: Don't issue ATS Invalidation request when device is disconnected {CVE-2024-26891}
  - dm: don't attempt to queue IO under RCU protection {CVE-2023-53860}
  - md: fix soft lockup in status_resync {CVE-2023-53620}
  - spi: qup: Don't skip cleanup in remove's error path {CVE-2023-53567}
  - md/raid10: prevent soft lockup while flush writes {CVE-2023-53151}
  - bpf, sockmap: Fix an infinite loop error when len is 0 in tcp_bpf_recvmsg_parser() {CVE-2023-53133}
  - spi: imx: Don't skip cleanup in remove's error path {CVE-2023-53225}
  - xsk: Add missing overflow check in xdp_umem_reg {CVE-2023-53080}
  - wifi: mt76: do not run mt76u_status_worker if the device is not running {CVE-2022-50735}
  - bpf: Skip task with pid=1 in send_signal_common() {CVE-2023-52992}
  - scsi: hisi_sas: Set debugfs_dir pointer to NULL after removing debugfs {CVE-2023-52808}
  - net: openvswitch: fix possible memory leak in ovs_meter_cmd_set() {CVE-2023-52702}
  - RDMA/irdma: Fix potential NULL-ptr-dereference {CVE-2023-52744}
  - i2c: designware: Fix handling of real but unexpected device interrupts {CVE-2022-50370}
  - usb: host: xhci: Fix potential memory leak in xhci_alloc_stream_info() {CVE-2022-50544}
  - tpm: acpi: Call acpi_put_table() to fix memory leak {CVE-2022-50562}
  - netdevsim: fix memory leak in nsim_drv_probe() when nsim_dev_resources_register() failed {CVE-2022-50500}
  - ntb_netdev: Use dev_kfree_skb_any() in interrupt context {CVE-2022-50476}
  - blk-mq: fix possible memleak when register 'hctx' failed {CVE-2022-50434}
  - ipvs: fix WARNING in __ip_vs_cleanup_batch() {CVE-2022-49918}
  - ACPI: APEI: Fix integer overflow in ghes_estatus_pool_init() {CVE-2022-49885}
  - xen/privcmd: fix error exit of privcmd_ioctl_dm_op() {CVE-2022-49989}
  - bpftool: Fix NULL pointer dereference when pin {PROG, MAP, LINK} without FILE {CVE-2022-49875}
  - can: j1939: j1939_send_one(): fix missing CAN header initialization {CVE-2022-49845}
  - ovl: Use "buf" flexible array for memcpy() destination {CVE-2022-49743}
  - scsi: scsi_transport_sas: Fix error handling in sas_phy_add() {CVE-2022-49839}
  - net: bcmgenet: Use stronger register read/writes to assure ordering {CVE-2022-49194}
  - ima: Fix a potential integer overflow in ima_appraise_measurement {CVE-2022-49643}
  - net: amd-xgbe: Fix skb data length underflow {CVE-2022-48743}
  - drm/i915/gt: fix refcount underflow in intel_engine_park_heartbeat {CVE-2026-31656}
  - octeontx2-pf: fix "UBSAN: shift-out-of-bounds error" {CVE-2025-71137}
  - ALSA: scarlett2: Fix buffer overflow in config retrieval {CVE-2026-23078}
  - mailbox: Prevent out-of-bounds access in fw_mbox_index_xlate() {CVE-2026-43281}
  - net: ipv6: ndisc: fix ndisc_ra_useropt to initialize nduseropt_padX fields to zero to prevent an info-leak {CVE-2026-43040}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup {CVE-2026-43027}
  - Bluetooth: MGMT: validate LTK enc_size on load {CVE-2026-43020}
  - rxrpc: Fix missing validation of ticket length in non-XDR key preparsing {CVE-2026-31696}
  - xfs: stop reclaim before pushing AIL during unmount {CVE-2026-31455}
  - bpf, test_run: Fix alignment problem in bpf_prog_test_run_skb() {CVE-2022-49840}
  - drivers: base: Free devm resources when unregistering a device {CVE-2023-53596}
  - ALSA: caiaq: fix stack out-of-bounds read in init_card {CVE-2026-31778}
  - ata: libata-transport: fix double ata_host_put() in ata_tport_add() {CVE-2022-49826}
  - tracing: Fix wild-memory-access in register_synth_event() {CVE-2022-49799}
  - kprobes: Skip clearing aggrprobe's post_handler in kprobe-on-ftrace case {CVE-2022-49779}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els2]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during rehash {CVE-2024-35854}
  - cifs: Fix memory leak when build ntlmssp negotiate blob failed {CVE-2022-50372}
  - scsi: lpfc: Check kzalloc() in lpfc_sli4_cgn_params_read() {CVE-2023-53038}
  - drm/amd/display: Do not set DRR on pipe Commit {CVE-2023-53042}
  - tcp: fix skb_copy_ubufs() vs BIG TCP {CVE-2023-53669}
  - clk: Fix clk_core_get NULL dereference {CVE-2024-27038}
  - drm/amd/display: Check null pointers before using dc->clk_mgr {CVE-2024-49907}
  - bpf: reject unhashed sockets in bpf_sk_assign {CVE-2023-53585}
  - driver core: fix resource leak in device_add() {CVE-2023-53594}
  - wifi: ath9k: hif_usb: fix memory leak of remain_skbs {CVE-2023-53641}
  - wifi: ath9k: verify the expected usb_endpoints are present {CVE-2022-50297}
  - drm/amd/display: Fix potential null-deref in dm_resume {CVE-2022-50535}
  - ext4: don't allow journal inode to have encrypt flag {CVE-2022-50277}
  - tls: get psock ref after taking rxlock to avoid leak {CVE-2024-35908}
  - cpumap: Zero-initialise xdp_rxq_info struct before running XDP program {CVE-2024-27431}
  - bpf: Guard stack limits against 32bit overflow {CVE-2023-52676}
  - can: isotp: isotp_sendmsg(): add result check for wait_event_interruptible() {CVE-2021-47457}
  - serial: core: fix transmit-buffer reset and memleak {CVE-2021-47527}
  - cpufreq: exit() callback is optional {CVE-2024-38615}
  - ext4: fix mb_cache_entry's e_refcnt leak in ext4_xattr_block_cache_find() {CVE-2024-39276}
  - tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets {CVE-2024-36905}
  - wifi: nl80211: reject iftype change with mesh ID change {CVE-2024-27410}
  - tcp: do not accept ACK of bytes we never sent {CVE-2023-52881}
  - crypto: pcrypt - Fix hungtask for PADATA_RESET {CVE-2023-52813}
  - net/mlx5: Properly link new fs rules into the tree {CVE-2024-35960}
  - usb: ulpi: fix memory leak on ulpi_register() error paths
  - usb: ulpi: fix double free in ulpi_register_interface() error path {CVE-2026-31759}
  - wifi: ath11k: fix htt pktlog locking {CVE-2023-52800}
  - net_sched: cls_flow: validate TCA_FLOW_RSHIFT attribute {CVE-2025-21653}
  - calipso: fix memory leak in netlbl_calipso_add_pass() {CVE-2023-52698}
  - wifi: iwlwifi: mvm: avoid NULL pointer dereference {CVE-2024-49929}
  - ext4: update orig_path in ext4_find_extent() {CVE-2024-49881}
  - drm/vmwgfx: Fix a deadlock in dma buf fence polling {CVE-2024-43863}
  - RDMA/restrack: Fix potential invalid address access {CVE-2024-42080}
  - net: can: j1939: Initialize unused data in j1939_send_one() {CVE-2024-42076}
  - nfsd: clear acl_access/acl_default after releasing them {CVE-2025-21796}
  - rtc: pl031: fix rtc features null pointer dereference {CVE-2022-49273}
  - net: veth: clear GRO when clearing XDP even when down {CVE-2024-26803}
  - coresight: cti: Fix hang in cti_disable_hw() {CVE-2022-50491}
  - scsi: qla2xxx: Fix deletion race condition {CVE-2023-53615}
  - iw_cxgb4: Fix potential NULL dereference in c4iw_fill_res_cm_id_entry() {CVE-2023-53476}
  - scsi: qla2xxx: Fix potential NULL pointer dereference {CVE-2023-53451}
  - usb: ucsi_acpi: Increase the command completion timeout {CVE-2023-53168}
  - drivers: base: dd: fix memory leak with using debugfs_lookup() {CVE-2023-53390}
  - USB: fix memory leak with using debugfs_lookup() {CVE-2023-53359}
  - PM: domains: fix memory leak with using debugfs_lookup() {CVE-2023-53202}
  - drm/client: Fix memory leak in drm_client_modeset_probe {CVE-2023-53288}
  - drivers: base: component: fix memory leak with using debugfs_lookup() {CVE-2023-53409}
  - USB: uhci: fix memory leak with using debugfs_lookup() {CVE-2023-53197}
  - media: uvcvideo: Handle cameras with invalid descriptors {CVE-2023-53437}
  - arm64: csum: Fix OoB access in IP checksum code for negative lengths {CVE-2023-53726}
  - bnxt: Do not read past the end of test names {CVE-2023-53010}
  - dax: make sure inodes are flushed before destroy cache {CVE-2022-49220}
  - cifs: Fix oops due to uncleared server->smbd_conn in reconnect {CVE-2023-53006}
  - net: flow_dissector: use DEBUG_NET_WARN_ON_ONCE {CVE-2024-42321}
  - PCI: Fix use-after-free of slot->bus on hot remove {CVE-2024-53194}
  - net/ipv6: release expired exception dst cached in socket {CVE-2024-56644}
  - net: sched: fix ordering of qlen adjustment {CVE-2024-53164}
  - watch_queue: Fix NULL dereference in error cleanup {CVE-2022-49257}
  - lz4: fix LZ4_decompress_safe_partial read out of bound {CVE-2022-49078}
  - vmxnet3: disable rx data ring on dma allocation failure {CVE-2024-40923}
  - ALSA: hda: intel-sdw-acpi: fix usage of device_get_named_child_node() {CVE-2024-36955}
  - Bluetooth: hci_{ldisc,serdev}: check percpu_init_rwsem() failure {CVE-2022-50374}
  - drm/amdgpu: amdgpu_ttm_gart_bind set gtt bound flag {CVE-2024-35817}
  - dm snapshot: fix lockup in dm_exception_table_exit {CVE-2024-35805}
  - nouveau: fix instmem race condition around ptr stores {CVE-2024-26984}
  - wireguard: netlink: access device through ctx instead of peer {CVE-2024-26950}
  - drm/i915/gt: Reset queue_priority_hint on parking {CVE-2024-26937}
  - netfilter: nft_set_pipapo: do not free live element {CVE-2024-26924}
  - dmaengine: fix NULL pointer in channel unregistration function {CVE-2023-52492}
  - PCI/PM: Drain runtime-idle callbacks before driver removal {CVE-2024-35809}
  - nvme-fc: do not wait in vain when unloading module {CVE-2024-26846}
  - netfilter: nf_conntrack_sip: fix use of uninitialized rtp_addr in process_sdp {CVE-2026-31427}
  - phylib: fix potential use-after-free {CVE-2022-48754}
  - mm/filemap: skip to create PMD-sized page cache if needed {CVE-2024-41031}
  - VMCI: Fix memcpy() run-time warning in dg_dispatch_as_host() {CVE-2024-35944}
  - mlxsw: spectrum_acl_tcam: Fix incorrect list API usage {CVE-2024-36006}
  - wifi: ath11k: decrease MHI channel buffer length to 8KB {CVE-2024-35938}
  - dyndbg: fix old BUG_ON in >control parser {CVE-2024-35947}
  - ALSA: core: Fix NULL module pointer assignment at card init {CVE-2024-38605}
  - wifi: iwlwifi: mvm: rfi: fix potential response leaks {CVE-2024-35912}
  - x86/fpu: Keep xfd_state in sync with MSR_IA32_XFD {CVE-2024-35801}
  - ipv6: avoid overflows in ip6_datagram_send_ctl() {CVE-2026-31415}
  - wifi: mac80211: don't return unset power in ieee80211_get_tx_power() {CVE-2023-52832}
  - i2c: core: Run atomic i2c xfer when !preemptible {CVE-2023-52791}
  - mmc: sdio: fix possible resource leaks in some error paths {CVE-2023-52730}
  - protect the fetch of ->fd[fd] in do_dup2() from mispredictions {CVE-2024-42265}
  - wifi: mac80211: fix potential sta-link leak {CVE-2024-35838}
  - octeontx2-af: avoid off-by-one read from userspace {CVE-2024-36957}
  - xen-netfront: Add missing skb_mark_for_recycle {CVE-2024-27393}
  - net: hns3: do not allow call hns3_nic_net_open repeatedly {CVE-2021-47400}
  - HID: sony: Fix a potential memory leak in sony_probe() {CVE-2023-52529}
  - netfilter: nfnetlink_log: fix uninitialized padding leak in NFULA_PAYLOAD {CVE-2026-31428}
  - mm/gup: fix gup_pud_range() for dax {CVE-2022-48986}
  - drm/virtio: Fix GEM handle creation UAF {CVE-2022-48899}
  - ipv4: ip_gre: make ipgre_header() robust {CVE-2026-23011}
  - ACPI: processor_idle: Fix memory leak in acpi_processor_power_exit() {CVE-2024-26894}
  - RDMA/umad: Reject negative data_len in ib_umad_write {CVE-2026-23243}
  - HID: logitech-hidpp: Prevent use-after-free on force feedback initialisation failure {CVE-2026-43049}
  - usb: class: cdc-wdm: fix reordering issue in read code path {CVE-2026-43427}
  - bpf, cpumap: Make sure kthread is running before map update returns {CVE-2023-53577}
  - wifi: mac80211: check tdls flag in ieee80211_tdls_oper {CVE-2026-43052}
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks {CVE-2026-23270}
  - net/sched: act_ct: fix skb leak and crash on ooo frags {CVE-2023-52610}
  - Bluetooth: L2CAP: Fix user-after-free {CVE-2022-50386}
  - mm/mempolicy: fix memory leak in set_mempolicy_home_node system call {CVE-2022-50391}
  - mm/kasan: fix double free for kasan pXds {CVE-2026-31686}
  - ext4: convert inline data to extents when truncate exceeds inline size {CVE-2026-31452}
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache {CVE-2026-31402}
  - dax: Fix dax_mapping_release() use after free {CVE-2023-53613}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els3]
changelog:
  - atm: lec: fix use-after-free in sock_def_readable() {CVE-2026-43050}
  - ALSA: usb-audio: Use the right limit for PCM OOB check
  - ALSA: usb-audio: Prevent excessive number of frames {CVE-2026-23208}
  - xen/privcmd: fix double free via VMA splitting {CVE-2026-31787}
  - cpufreq: governor: fix double free in cpufreq_dbs_governor_init() error path {CVE-2026-43328}
  - cpufreq: governor: Free dbs_data directly when gov->init() fails {CVE-2026-43328}
  - rcu: Fix rcu_read_unlock() deadloop due to softirq
  - rcu: Fix racy re-initialization of irq_work causing hangs
  - RDMA/efa: Fix possible deadlock {CVE-2026-31493}
  - RDMA/efa: Fix use of completion ctx after free {CVE-2026-31493}
  - RDMA/efa: Improve admin completion context state machine {CVE-2026-31493}
  - RDMA/efa: Check stored completion CTX command ID with received one {CVE-2026-31493}
  - RDMA/efa: Extend admin timeout error print
  - RDMA/efa: Properly handle unexpected AQ completions {CVE-2026-31493}
  - rcu: Fix rcu_read_unlock() deadloop due to IRQ work {CVE-2025-39744}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() {CVE-2026-23455}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported {CVE-2025-22075}
  - kernel/printk/index.c: fix memory leak with using debugfs_lookup() {CVE-2023-53402}
  - wifi: iwlwifi: don't warn when if there is a FW error {CVE-2025-38096}
  - md/raid5-cache: fix null-ptr-deref for r5l_flush_stripe_to_raid() {CVE-2023-53210}
  - exfat: fix the infinite loop in exfat_readdir() {CVE-2024-57940}
  - af_netlink: Fix shift out of bounds in group mask calculation {CVE-2022-49197}
  - xfrm_user: fix info leak in build_mapping() {CVE-2026-43089}
  - udf: Fix preallocation discarding at indirect extent boundary {CVE-2022-48946}
  - efi: Do not import certificates from UEFI Secure Boot for T2 Macs {CVE-2022-49357}
  - kernel/resource: fix kfree() of bootmem memory again {CVE-2022-49190}
  - smb: client: fix warning in cifs_smb3_do_mount() {CVE-2023-53230}
  - sctp: Fix null-ptr-deref in reuseport_add_sock(). {CVE-2024-44935}
  - RDMA/bnxt_re: Fix a bug while setting up Level-2 PBL pages {CVE-2024-50208}
  - drm/amdgpu: avoid using null object of framebuffer {CVE-2024-41093}
  - firmware: cs_dsp: Return error if block header overflows file {CVE-2024-42238}
  - ata: libata-sff: Ensure that we cannot write outside the allocated buffer {CVE-2025-21738}
  - net: hinic: fix memory leak when reading function table {CVE-2022-50438}
  - device property: fix of node refcount leak in fwnode_graph_get_next_endpoint() {CVE-2022-49752}
  - libceph: fix race between delayed_work() and ceph_monc_stop() {CVE-2024-42232}
  - usbnet: fix memory leak in error case {CVE-2022-49657}
  - hwmon: (w83791d) Convert macros to functions to avoid TOCTOU {CVE-2025-71111}
  - seccomp: Move copy_seccomp() to no failure path. {CVE-2022-50661}
  - net/mlx5: fs, lock FTE when checking if active {CVE-2024-53121}
  - nvme-pci: fix freeing of the HMB descriptor table {CVE-2024-56756}
  - leds: class: Protect brightness_show() with led_cdev->led_access mutex {CVE-2024-56587}
  - bpf, sockmap: Check for any of tcp_bpf_prots when cloning a listener {CVE-2023-52986}
  - RDMA/uverbs: Prevent integer overflow issue {CVE-2024-57890}
  - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT {CVE-2026-23125}
  - tracing: Fix memory leak in test_gen_synth_cmd() and test_empty_synth_event() {CVE-2022-49800}
  - kprobes: Fix check for probe enabled in kill_kprobe() {CVE-2022-50266}
  - NFSv4.2: fix nfs4_listxattr kernel BUG at mm/usercopy.c:102 {CVE-2024-26870}
  - i915/perf: Fix NULL deref bugs with drm_dbg() calls {CVE-2023-52788}
  - can: mcp251x: fix deadlock in error path of mcp251x_open {CVE-2026-23357}
  - regmap-irq: Use the new num_config_regs property in regmap_add_irq_chip_fwnode {CVE-2022-50558}
  - wifi: cfg80211: Set correct chandef when starting CAC {CVE-2024-49937}
  - netfilter: nf_tables: prevent nf_skb_duplicated corruption {CVE-2024-49952}
  - can: isotp: fix potential CAN frame reception race in isotp_rcv() {CVE-2022-48830}
  - bpf: Fix memory leaks in __check_func_call {CVE-2022-49837}
  - configfs: fix a race in configfs_{,un}register_subsystem() {CVE-2022-48931}
  - RDMA/mad: Improve handling of timed out WRs of mad agent {CVE-2024-50095}
  - cifs: Fix connections leak when tlink setup failed {CVE-2022-49822}
  - usb: atm: cxacru: fix endpoint checking in cxacru_bind() {CVE-2024-41097}
  - tcp: add sanity checks to rx zerocopy {CVE-2024-26640}
  - NFSD: Prevent a potential integer overflow {CVE-2024-53146}
  - bpf, cpumap: Handle skb as well when clean up ptr_ring {CVE-2023-53660}
  - team: fix null-ptr-deref when team device type is changed {CVE-2023-52574}
  - fbdev: efifb: Register sysfs groups through driver core {CVE-2024-49925}
  - bpf: devmap: provide rxq after redirect {CVE-2024-50162}
  - net: phy: micrel: Allow probing without .driver_data {CVE-2022-49472}
  - inotify: Avoid reporting event with invalid wd {CVE-2023-54119}
  - USB: hub: Ignore non-compliant devices with too many configs or interfaces {CVE-2025-21776}
  - wifi: ath11k: add srng->lock for ath11k_hal_srng_* in monitor mode {CVE-2024-58096}
  - RDMA/irdma: Fix data race on CQP request done {CVE-2023-54292}
  - fscache: Fix oops due to race with cookie_lru and use_cookie {CVE-2022-48989}
  - perf/x86/intel/uncore: Fix NULL pointer dereference issue in upi_fill_topology() {CVE-2023-52450}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_flows.c {CVE-2024-56727}
  - wifi: iwlwifi: fix debug actions order {CVE-2025-38045}
  - tracing/hist: Fix out-of-bound write on 'action_data.var_ref_idx' {CVE-2022-50553}
  - net: ipv4: fix one memleak in __inet_del_ifa() {CVE-2023-53995}
  - exfat: fix memory leak in exfat_load_bitmap() {CVE-2024-50013}
  - vp_vdpa: fix id_table array not null terminated error {CVE-2024-53110}
  - intel_th: Fix a resource leak in an error handling path {CVE-2022-50143}
  - leds: led-class: Only Add LED to leds_list when it is fully ready {CVE-2026-23101}
  - usb: gadget: core: Check for unset descriptor {CVE-2024-44960}
  - drm/amdkfd: Fix lock dependency warning with srcu {CVE-2023-52632}
  - atm: clip: Fix NULL pointer dereference in vcc_sendmsg() {CVE-2025-38458}
  - PM / devfreq: Check governor before using governor->name {CVE-2025-38609}
  - tls: fix missing memory barrier in tls_init {CVE-2024-36489}
  - cpufreq: scmi: Fix null-ptr-deref in scmi_cpufreq_get_rate() {CVE-2025-37830}
  - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery {CVE-2024-40977}
  - nvdimm: Fix firmware activation deadlock scenarios {CVE-2022-49446}
  - wifi: mac80211: sdata can be NULL during AMPDU start {CVE-2022-48875}
  - can: m_can: pci: add missing m_can_class_free_dev() in probe/remove methods {CVE-2022-49024}
  - wifi: ath10k: Fix memory leak in management tx {CVE-2024-50236}
  - vsock: prevent null-ptr-deref in vsock_*[has_data|has_space] {CVE-2025-21666}
  - netdevsim: fix memory leak in nsim_bus_dev_new() {CVE-2022-50772}
  - fs: relax assertions on failure to encode file handles {CVE-2024-57924}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dmac_flt.c {CVE-2024-56707}
  - ceph: fix deadlock or deadcode of misusing dget() {CVE-2023-52583}
  - bpf, verifier: Fix memory leak in array reallocation for stack state {CVE-2022-49878}
  - ip6_gre: make ip6gre_header() robust {CVE-2025-71098}
  - ACPICA: Avoid walking the Namespace if start_node is NULL {CVE-2025-71118}
  - net/mlx5e: kTLS, Fix incorrect page refcounting {CVE-2024-53138}
  - gve: Clear napi->skb before dev_kfree_skb_any() {CVE-2024-40937}
  - atm: clip: Fix memory leak of struct clip_vcc. {CVE-2025-38546}
  - crypto: seqiv - Do not use req->iv after crypto_aead_encrypt {CVE-2025-71131}
  - xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration {CVE-2024-45006}
  - irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
  - CDC-NCM: avoid overflow in sanity checking {CVE-2022-48938}
  - Bluetooth: Fix crash when replugging CSR fake controllers {CVE-2022-48982}
  - platform/x86: mxm-wmi: fix memleak in mxm_wmi_call_mx[ds|mx]() {CVE-2022-50521}
  - ptp: Ensure info->enable callback is always set {CVE-2025-21814}
  - perf/arm_dmc620: Fix hotplug callback leak in dmc620_pmu_init() {CVE-2022-50820}
  - drm: Fix potential null-ptr-deref due to drmm_mode_config_init() {CVE-2022-50556}
  - wifi: rtl8xxxu: Fix memory leaks with RTL8723BU, RTL8192EU {CVE-2023-54036}
  - xfrm6: check ip6_dst_idev() return value in xfrm6_get_saddr() {CVE-2024-40959}
  - drm/amdgpu: Fix smatch static checker warning {CVE-2024-46835}
  - svcrdma: Address an integer overflow {CVE-2024-53151}
  - dma-debug: fix a possible deadlock on radix_lock {CVE-2024-47143}
  - wifi: cfg80211: wext: add extra SIOCSIWSCAN data check {CVE-2024-41072}
  - regulator: core: fix use_count leakage when handling boot-on {CVE-2022-50250}
  - tpm: use try_get_ops() in tpm-space.c {CVE-2022-49286}
  - ata: libata-transport: fix error handling in ata_tdev_add() {CVE-2022-49823}
  - padata: Always leave BHs disabled when running ->parallel() {CVE-2022-50382}
  - can: usb_8dev: usb_8dev_read_bulk_callback(): fix URB memory leak {CVE-2026-23108}
  - serial: core: check uartclk for zero to avoid divide by zero {CVE-2024-43893}
  - cifs: fix potential memory leaks in session setup {CVE-2023-53008}
  - tty: fix out-of-bounds access in tty_driver_lookup_tty() {CVE-2023-54198}
  - nvdimm: Fix memleak of pmu attr_groups in unregister_nvdimm_pmu() {CVE-2023-53697}
  - HID: logitech-hidpp: Check maxfield in hidpp_get_report_length() {CVE-2026-43136}
  - SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
  - drm/ioc32: stop speculation on the drm_compat_ioctl path {CVE-2026-31781}
  - ext4: fix i_disksize exceeding i_size problem in paritally written case {CVE-2023-53270}
  - wifi: nl80211: fix NULL-ptr deref in offchan check {CVE-2023-53113}
  - wifi: ath9k: Fix potential stack-out-of-bounds write in ath9k_wmi_rsp_callback() {CVE-2023-53717}
  - ASoC: SOF: Add some bounds checking to firmware data {CVE-2024-26927}
  - regulator: core: Prevent integer underflow {CVE-2022-50582}
  - power: supply: fix null pointer dereferencing in power_supply_get_battery_info {CVE-2022-50276}
  - netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() {CVE-2026-43450}
  - nvdimm/bus: Fix potential use after free in asynchronous initialization {CVE-2026-31399}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id {CVE-2025-68724}
  - nbd: defer config unlock in nbd_genl_connect {CVE-2025-68366}
  - netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets {CVE-2026-31685}
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq {CVE-2026-43051}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks {CVE-2026-43158}
  - wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els4]
changelog:
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in cn10k.c {CVE-2024-56726}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_common.c {CVE-2024-56679}
  - USB: chipidea: fix memory leak with using debugfs_lookup() {CVE-2023-53334}
  - drivers: serial: jsm: fix some leaks in probe {CVE-2022-50312}
  - drm: amd: display: Fix memory leakage {CVE-2023-53605}
  - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent {CVE-2026-43026}
  - net: Drop the lock in skb_may_tx_timestamp() {CVE-2026-43216}
  - nouveau/dpcd: return EBUSY for aux xfer if the device is asleep {CVE-2026-43381}
  - ext4: avoid allocate block from corrupted group in ext4_mb_find_by_goal() {CVE-2026-43068}
  - net: mdio: unexport __init-annotated mdio_bus_init() {CVE-2022-49350}
  - netfilter: ipset: Rework long task execution when adding/deleting entries {CVE-2023-53549}
  - ALSA: hda: fix a possible null-pointer dereference due to data race in snd_hdac_regmap_sync() {CVE-2023-53275}
  - thermal: intel_powerclamp: Use get_cpu() instead of smp_processor_id() to avoid crash {CVE-2022-50494}
  - can: ems_usb: ems_usb_read_bulk_callback(): check the proper length of a message {CVE-2026-23307}
  - usb: image: mdc800: kill download URB on timeout {CVE-2026-43425}
  - tipc: fix divide-by-zero in tipc_sk_filter_connect() {CVE-2026-43411}
  - cgroup/cpuset: Fix wrong check in update_parent_subparts_cpumask() {CVE-2023-52942}
  - net/usb: kalmia: Don't pass act_len in usb_bulk_msg error path {CVE-2023-52703}
  - usb: typec: tcpci: fix of node refcount leak in tcpci_register_port() {CVE-2022-50246}
  - bus: mhi: host: Range check CHDBOFF and ERDBOFF {CVE-2023-53598}
  - hwmon: (coretemp) Simplify platform device handling {CVE-2023-53612}
  - scsi: mpi3mr: Avoid memcpy field-spanning write WARNING {CVE-2024-36920}
  - dm crypt: add cond_resched() to dmcrypt_write() {CVE-2023-53051}
  - xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
  - wifi: cfg80211: handle 2x996 RU allocation in cfg80211_calculate_bitrate_he() {CVE-2024-43879}
  - RDMA/cxgb4: Fix potential null-ptr-deref in pass_establish() {CVE-2023-53335}
  - regulator: check that dummy regulator has been probed before using it {CVE-2025-22008}
  - HID: prodikeys: Check presence of pm->input_ep82 {CVE-2026-43251}
  - perf/smmuv3: Fix hotplug callback leak in arm_smmu_pmu_init() {CVE-2022-50510}
  - wifi: ath11k: fix dfs radar event locking {CVE-2023-52798}
  - trace/blktrace: fix memory leak with using debugfs_lookup() {CVE-2023-53408}
  - dm-verity: correctly handle dm_bufio_client_create() failure {CVE-2026-43132}
  - pstore: ram_core: fix incorrect success return when vmap() fails {CVE-2026-43124}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk {CVE-2026-43043}
  - net: use skb_header_pointer() for TCPv4 GSO frag_off check {CVE-2026-43036}
  - scsi: mpi3mr: Fix config page DMA memory leak {CVE-2023-53120}
  - net/mlx5: handle errors in mlx5_chains_create_table() {CVE-2025-21975}
  - net/mlx5: DR, fix memory leak in mlx5dr_cmd_create_reformat_ctx {CVE-2023-53546}
  - drm/amdgpu: handle amdgpu_cgs_create_device() errors in amd_powerplay_create() {CVE-2025-37852}
  - bpf: Prevent decl_tag from being referenced in func_proto arg {CVE-2022-50883}
  - arm64: set __exception_irq_entry with __irq_entry as a default {CVE-2023-54322}
  - class: fix possible memory leak in __class_register() {CVE-2022-50578}
  - ALSA: usb-audio: Stop parsing channels bits when all channels are found. {CVE-2024-27436}
  - net/mlx5: fix potential memory leak in mlx5e_init_rep_rx {CVE-2023-54106}
  - net/mlx5: E-Switch, Fix an Oops in error handling code {CVE-2023-53058}
  - scsi: scsi_dh_alua: Fix memleak for 'qdata' in alua_activate() {CVE-2023-53078}
  - ice: xsk: disable txq irq before flushing hw {CVE-2023-53102}
  - selinux: fix memleak in security_read_state_kernel() {CVE-2022-50201}
  - efi: runtime: Fix potential overflow of soft-reserved region size {CVE-2024-26843}
  - drm/amdgpu: Fix potential null pointer derefernce {CVE-2023-52814}
  - ata: libata-core: Fix null pointer dereference on error {CVE-2024-41098}
  - atm: lec: fix null-ptr-deref in lec_arp_clear_vccs {CVE-2026-23286}
  - ipv6: fix NULL pointer deref in ip6_rt_get_dev_rcu() {CVE-2026-23304}
  - drm/amd/display: Fix system hang while resume with TBT monitor {CVE-2024-50003}
  - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator {CVE-2026-43085}
  - KVM: SEV: Drop WARN on large size for KVM_MEMORY_ENCRYPT_REG_REGION {CVE-2026-31590}
  - l2tp: Drop large packets with UDP encap {CVE-2026-43080}
  - tun: limit printing rate when illegal packet received by tun dev {CVE-2024-27013}
  - xfrm: always flush state and policy upon NETDEV_UNREGISTER event {CVE-2026-43167}
  - KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding {CVE-2026-43315}
  - xenbus: Use kref to track req lifetime {CVE-2025-37949}
  - wifi: prevent A-MSDU attacks in mesh networks {CVE-2025-38512}
  - KVM: x86: Acquire kvm->srcu when handling KVM_SET_VCPU_EVENTS {CVE-2024-46830}
  - scsi: smartpqi: Fix disable_managed_interrupts {CVE-2024-26742}
  - IB/mlx5: Fix init stage error handling to avoid double free of same QP and UAF {CVE-2023-52851}
  - vhost-vdpa: fix use after free in vhost_vdpa_probe() {CVE-2023-52795}
  - ndisc: ndisc_send_redirect() cleanup
  - ndisc: ndisc_send_redirect() must use dev_get_by_index_rcu()
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward()
  - ipv6: icmp: convert to dev_net_rcu()
  - ipv4: icmp: convert to dev_net_rcu()
  - ipv4: use RCU protection in __ip_rt_update_pmtu() {CVE-2025-21766}
  - ipv6: use RCU protection in ip6_default_advmss() {CVE-2025-21765}
  - fix: ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - neighbour: use RCU protection in __neigh_notify() {CVE-2025-21763}
  - arp: use RCU protection in arp_xmit() {CVE-2025-21762}
  - openvswitch: use RCU protection in ovs_vport_cmd_fill_info() {CVE-2025-21761}
  - ndisc: extend RCU protection in ndisc_send_skb() {CVE-2025-21760}
  - ipv6: mcast: extend RCU protection in igmp6_send() {CVE-2025-21759}
  - ipv6: mcast: add RCU protection to mld_newpack() {CVE-2025-21758}
  - ipv4: use RCU protection in rt_is_expired()
  - ipv4: use RCU protection in inet_select_addr()
  - ipv4: add RCU protection to ip4_dst_hoplimit()
  - flow_dissector: use RCU protection to fetch dev_net()
  - net: add dev_net_rcu() helper
  - net: treat possible_net_t net pointer as an RCU one and add read_pnet_rcu()
  - scsi: iscsi_tcp: Fix UAF during login when accessing the shost ipaddress {CVE-2023-52974}
  - RDMA/iwcm: Fix WARNING:at_kernel/workqueue.c:#check_flush_dependency {CVE-2024-47696}
  - perf/x86/amd/core: Always clear status for idx {CVE-2023-53073}
  - tcp_bpf: fix return value of tcp_bpf_sendmsg() {CVE-2024-46783}
  - RDMA/umem: Fix double dma_buf_unpin in failure path {CVE-2026-43128}
  - netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() {CVE-2026-43453}
  - drm/ttm: Fix a NULL pointer dereference {CVE-2023-53095}
  - net: sched: cls_api: fix tc_chain_fill_node to initialize tcm_info to zero to prevent an info-leak {CVE-2026-43035}
  - fbcon: check return value of con2fb_acquire_newinfo() {CVE-2026-43123}
  - ipv4: prevent potential spectre v1 gadget in fib_metrics_match() {CVE-2023-52996}
  - perf/x86/intel/uncore: Skip discovery table for offline dies {CVE-2026-43079}
  - mm/page_alloc: clear page->private in free_pages_prepare() {CVE-2026-43303}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold {CVE-2026-31408}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() {CVE-2026-23111}
  - netfilter: nf_tables: restore set elements when delete set fails {CVE-2024-27012}
  - drm/amdkfd: Correct the migration DMA map direction {CVE-2024-57897}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els5]
changelog:
  - spi: spi-fsl-lpspi: fix teardown order issue (UAF) {CVE-2026-31485}
  - Buffer overflow in drivers/xen/sys-hypervisor.c {CVE-2026-31786}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() {CVE-2026-43037}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() {CVE-2026-31419}
  - bonding: do not set usable_slaves for broadcast mode {CVE-2026-31419}
  - net: bonding: update the slave array for broadcast mode {CVE-2026-31419}
  - dlm: validate length in dlm_search_rsb_tree {CVE-2026-43125}
  - net: usb: cdc_ncm: add ndpoffset to NDP16 nframes bounds check {CVE-2026-23448}
  - net: Fix an unsafe loop on the list {CVE-2024-50024}
  - sctp: sysctl: plpmtud_probe_interval: avoid using current->nsproxy {CVE-2025-21636}
  - wifi: ath9k: avoid referencing uninit memory in ath9k_wmi_ctrl_rx {CVE-2023-54300}
  - wifi: nl80211: reject cooked mode if it is set along with other flags {CVE-2025-21909}
  - drm/amd/display: Add null check for top_pipe_to_program in commit_planes_for_stream {CVE-2024-49913}
  - xfrm: validate new SA's prefixlen using SA family when sel.family is unset {CVE-2024-50142}
  - serial: imx: Introduce timeout when waiting on transmitter empty {CVE-2024-40967}
  - iommu/amd/iommu_v2: Fix pasid_state refcount dec hit 0 warning on pasid unbind {CVE-2023-53501}
  - octeontx2-af: Add validation before accessing cgx and lmac {CVE-2023-53654}
  - sctp: sysctl: rto_min/max: avoid using current->nsproxy {CVE-2025-21639}
  - net: phy: dp83822: Fix null pointer access on DP83825/DP83826 devices {CVE-2023-52984}
  - sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start {CVE-2024-49944}
  - netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path {CVE-2026-43451}
  - thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR {CVE-2022-48703}
  - x86/mm: Fix pti_clone_pgtable() alignment assumption {CVE-2024-44965}
  - net: usb: asix_devices: add phy_mask for ax88772 mdio bus {CVE-2025-38725}
  - ALSA: hda: Do not unset preset when cleaning up codec {CVE-2023-52736}
  - drm/amd/display: Add NULL check for function pointer in dcn32_set_output_transfer_func {CVE-2024-49909}
  - Bluetooth: hci_event: Align BR/EDR JUST_WORKS paring with LE {CVE-2024-53144}
  - fuse: Initialize beyond-EOF page contents before setting uptodate {CVE-2024-44947}
  - sctp: sysctl: udp_port: avoid using current->nsproxy {CVE-2025-21637}
  - dm stats: check for and propagate alloc_percpu failure {CVE-2023-53044}
  - netpoll: Fix race condition in netpoll_owner_active {CVE-2024-41005}
  - tracing: Fix overflow in get_free_elt() {CVE-2024-43890}
  - mm/slub: avoid accessing metadata when pointer is invalid in object_err() {CVE-2025-39902}
  - xen/netfront: stop tx queues during live migration {CVE-2022-48969}
  - Bluetooth: btusb: clamp SCO altsetting table indices {CVE-2026-31497}
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free {CVE-2025-38105}
  - can: j1939: make j1939_sk_bind() fail if device is no longer registered {CVE-2025-39925}
  - nvme-fc: Prevent null pointer dereference in nvme_fc_io_getuuid() {CVE-2023-52508}
  - smb: client: Don't log plaintext credentials in cifs_set_cifscreds {CVE-2026-23303}
  - cifs: Fix integer overflow while processing acdirmax mount option {CVE-2025-21963}
  - netfilter: nfnetlink_log: account for netlink header size {CVE-2026-31416}
  - drm/amdgpu/vkms: fix a possible null pointer dereference {CVE-2023-52815}
  - drm/amd/amdgpu: Check tbo resource pointer {CVE-2024-46807}
  - bonding: fix null pointer deref in bond_ipsec_offload_ok {CVE-2024-44990}
  - wifi: mac80211: do not pass a stopped vif to the driver in .get_txpower {CVE-2024-50237}
  - trace_events_hist: add check for return value of 'create_hist_field' {CVE-2023-53005}
  - drm/amdkfd: Add sync after creating vram bo {CVE-2023-53009}
  - bpf: Send signals asynchronously if !preemptible {CVE-2025-21728}
  - drm/client: fix null pointer dereference in drm_client_modeset_probe {CVE-2024-43894}
  - ext4: correct grp validation in ext4_mb_good_group {CVE-2023-53861}
  - RDMA/irdma: Initialize free_qp completion before using it {CVE-2026-31492}
  - usb: udc: remove warning when queue disabled ep {CVE-2024-35822}
  - bpf: Remove tst_run from lwt_seg6local_prog_ops. {CVE-2024-46754}
  - Bluetooth: hci_core: Fix not checking skb length on hci_acldata_packet {CVE-2024-56590}
  - tls: stop recv() if initial process_rx_list gave us non-DATA {CVE-2024-58239}
  - iommu/vt-d: Clean up si_domain in the init_dmars() error path {CVE-2022-50482}
  - ext4: update s_journal_inum if it changes after journal replay {CVE-2023-53091}
  - cifs: Fix xid leak in cifs_copy_file_range() {CVE-2022-50643}
  - wifi: ath9k_htc: Use __skb_set_length() for resetting urb before resubmit {CVE-2024-49938}
  - nbd: null check for nla_nest_start {CVE-2024-27025}
  - netfilter: ipset: Hold module reference while requesting a module {CVE-2024-56637}
  - drm/amd/display: Stop amdgpu_dm initialize when stream nums greater than 6 {CVE-2024-46817}
  - Bluetooth: L2CAP: Validate PDU length before reading SDU length in l2cap_ecred_data_rcv() {CVE-2026-31512}
  - Bluetooth: MGMT: Add error handling to pair_device() {CVE-2024-43884}
  - netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
  - nvme-pci: fix mempool alloc size {CVE-2022-50756}
  - fs: fix fd table size alignment properly {CVE-2024-45025}
  - gpio: sim: fix a memory leak {CVE-2023-52706}
  - ice: switch: fix potential memleak in ice_add_adv_recipe() {CVE-2022-48709}
  - netfilter: ebtables: fix memory leak when blob is malformed {CVE-2022-48641}
  - mfd: syscon: Fix null pointer dereference in of_syscon_register() {CVE-2023-52467}
  - netfilter: ipset: drop logically empty buckets in mtype_del {CVE-2026-31418}
  - scsi: megaraid_sas: Fix for a potential deadlock {CVE-2024-57807}
  - ALSA: hda: Fix possible null-ptr-deref when assigning a stream {CVE-2023-52806}
  - drm/amd/display: Avoid NULL dereference of timing generator {CVE-2023-52753}
  - netfilter: nft_socket: fix sk refcount leaks {CVE-2024-46855}
  - Bluetooth: Disable SCO support if READ_VOICE_SETTING is unsupported/broken {CVE-2025-38099}
  - objtool: Fix memory leak in create_static_call_sections() {CVE-2023-53423}
  - ceph: defer stopping mdsc delayed_work
  - drm/amd: Fix UBSAN array-index-out-of-bounds for Polaris and Tonga {CVE-2023-52819}
  - rethook: fix a potential memleak in rethook_alloc() {CVE-2022-49795}
  - mmc: sdhci-pci: Fix possible memory leak caused by missing pci_dev_put() {CVE-2022-49787}
  - scsi: mpi3mr: Fix mpi3mr_hba_port memory leak in mpi3mr_remove() {CVE-2023-53132}
  - cifs: fix small mempool leak in SMB2_negotiate() {CVE-2022-49938}
  - regulator: of: Fix refcount leak bug in of_get_regulation_constraints() {CVE-2022-50191}
  - watchdog: sp5100_tco: Fix a memory leak of EFCH MMIO resource {CVE-2022-50110}
  - drm/ttm: fix bulk_move corruption when adding a entry {CVE-2023-53444}
  - clk: Fix memory leak in devm_clk_notifier_register() {CVE-2023-53674}
  - md: raid1: fix potential OOB in raid1_remove_disk() {CVE-2023-53722}
  - wifi: mt76: mt7921: fix skb leak by txs missing in AMSDU {CVE-2023-54052}
  - drm/amd/display: Pass non-null to dcn20_validate_apply_pipe_split_flags {CVE-2024-49923}
  - recordmcount: Fix memory leaks in the uwrite function {CVE-2023-53318}
  - crypto: cavium - prevent integer overflow loading firmware {CVE-2022-50330}
  - integrity: Fix memory leakage in keyring allocation error path {CVE-2022-50395}
  - mmc: toshsd: fix return value check of mmc_add_host() {CVE-2022-50886}
  - RDMA/efa: Fix wrong resources deallocation order {CVE-2023-54201}
  - inet: read sk->sk_family once in inet_recv_error() {CVE-2024-26679}
  - ALSA: pcm: Add sanity NULL check for the default mmap fault handler {CVE-2024-53180}
  - net_sched: Prevent creation of classes with TC_H_ROOT {CVE-2025-21971}
  - net: usb: smsc95xx: Limit packet length to skb->len {CVE-2023-53062}
  - scsi: lpfc: Fix possible memory leak in lpfc_rcv_padisc() {CVE-2024-35930}
  - devres: Fix memory leakage caused by driver API devm_free_percpu() {CVE-2024-43871}
  - rdma/cxgb4: Prevent potential integer overflow on 32bit {CVE-2024-57973}
  - ACPI: x86: s2idle: Catch multiple ACPI_TYPE_PACKAGE objects {CVE-2023-53708}
  - rxrpc: Fix missing locking causing hanging calls {CVE-2024-50294}
  - wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext() {CVE-2024-50008}
  - ELF: fix kernel.randomize_va_space double read {CVE-2024-46826}
  - crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
  - drm/amd/pm: fix null pointer access {CVE-2025-38705}
  - ALSA: line6: Fix racy access to midibuf {CVE-2024-44954}
  - ALSA: us122l: Use snd_card_free_when_closed() at disconnection {CVE-2024-56532}
  - drm/vmwgfx: fix a memleak in vmw_gmrid_man_get_node {CVE-2023-52662}
  - drm/amd/display: Initialize denominators' default to 1 {CVE-2024-49899}
  - ipmi: fix use after free in _ipmi_destroy_user() {CVE-2022-50677}
  - Bluetooth: Fix memory leak in hci_req_sync_complete() {CVE-2024-35978}
  - null_blk: fix validation of block size {CVE-2024-41077}
  - ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
  - cifs: Fix integer overflow while processing acregmax mount option {CVE-2025-21964}
  - pm: cpupower: bench: Prevent NULL dereference on malloc failure {CVE-2025-37841}
  - nvmet-tcp: fix kernel crash if commands allocation fails {CVE-2024-46737}
  - netdevsim: Add trailing zero to terminate the string in nsim_nexthop_bucket_activity_write() {CVE-2024-50259}
  - wireguard: allowedips: avoid unaligned 64-bit memory accesses {CVE-2024-42247}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37770}
  - drm/sched: Increment job count before swapping tail spsc queue {CVE-2025-38515}
  - i2c: qup: jump out of the loop in case of timeout {CVE-2025-38671}
  - brcmfmac: return error when getting invalid max_flowrings from dongle {CVE-2022-50358}
  - PNP: fix name memory leak in pnp_alloc_dev() {CVE-2022-50278}
  - NFSv4/pNFS: Fix a race to wake on NFS_LAYOUT_DRAIN {CVE-2025-38393}
  - regmap: Fix race condition in hwspinlock irqsave routine {CVE-2026-23071}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37768}
  - scsi: target: tcm_loop: Fix possible name leak in tcm_loop_setup_hba_bus() {CVE-2022-49780}
  - RDMA/cm: Fix leaking the multicast GID table reference {CVE-2025-71084}
  - netfilter: ctnetlink: ensure safe access to master conntrack {CVE-2026-43116}
  - drop_monitor: fix incorrect initialization order {CVE-2025-21862}
  - wifi: nl80211: disallow setting special AP channel widths {CVE-2024-43912}
  - net/mlx5: Fix steering rules cleanup {CVE-2023-53079}
  - usbnet: Fix using smp_processor_id() in preemptible code warnings {CVE-2025-40164}
  - mptcp: fix slab-use-after-free in __inet_lookup_established {CVE-2026-31669}
  - Bluetooth: L2CAP: handle NULL sock pointer in l2cap_sock_alloc {CVE-2024-58009}
  - fs/binfmt_elf: Fix memory leak in load_elf_binary() {CVE-2022-50466}
  - drm/amdgpu: set the right AMDGPU sg segment limitation {CVE-2024-56594}
  - bridge: mcast: Fix use-after-free during router port configuration {CVE-2025-38248}
  - xfrm: hold dev ref until after transport_finish NF_HOOK {CVE-2026-31663}
  - fuse: reject oversized dirents in page cache {CVE-2026-31694}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation {CVE-2026-31488}
  - net/mlx5: Collect command failures data only for known commands {CVE-2023-53340}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr {CVE-2025-68183}
  - scsi: sg: Do not sleep in atomic context {CVE-2025-40259}
  - scsi: sd: Fix off-by-one error in sd_read_block_characteristics() {CVE-2024-47682}
  - mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() {CVE-2026-31586}
  - nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set {CVE-2026-43449}
  - nbd: fix race between timeout and normal completion {CVE-2024-49855}
  - iommufd/iova_bitmap: Fix shift-out-of-bounds in iova_bitmap_offset_to_index() {CVE-2025-21724}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els6]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption {CVE-2026-46331}
  - unshare: fix unshare_fs() handling {CVE-2026-43472}
  - net/sched: sch_hfsc: fix divide-by-zero in rtsc_min() {CVE-2026-31423}
  - net/sched: cls_flow: fix NULL pointer dereference on shared blocks {CVE-2026-31422}
  - net/sched: cls_fw: fix NULL pointer dereference on shared blocks {CVE-2026-31421}
  - dm: fix queue start/stop imbalance under suspend/load/resume races {CVE-2025-40134}
  - ext4: avoid allocating blocks from corrupted group in ext4_mb_try_best_found() {CVE-2024-26773}
  - ext4: fix i_data_sem unlock order in ext4_ind_migrate() {CVE-2024-50006}
  - xen: Fix the issue of resource not being properly released in xenbus_dev_probe() {CVE-2024-53198}
  - HID: pidff: Fix null pointer dereference in pidff_find_fields {CVE-2025-37862}
  - crypto: af_alg - Set merge to zero early in af_alg_sendmsg {CVE-2025-39931}
  - x86/cpu/hygon: Add missing resctrl_cpu_detect() in bsp_init helper {CVE-2025-39681}
  - can: kvaser_usb: kvaser_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23061}
  - bonding: restore IFF_MASTER/SLAVE flags on bond enslave ether type change {CVE-2023-53103}
  - NFS: Fix a potential data corruption {CVE-2023-53711}
  - NFS: Fix a use after free in nfs_direct_join_group() {CVE-2023-53711}
  - hwmon: (w83791d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47386}
  - scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload {CVE-2024-36919}
  - x86/mm: Ensure input to pfn_to_kaddr() is treated as a 64-bit type {CVE-2023-52659}
  - Input: uinput - reject requests with unreasonable number of slots {CVE-2024-46745}
  - afs: Fix the maximum cell name length {CVE-2025-21646}
  - drm/i915: Avoid potential vm use-after-free {CVE-2023-52931}
  - interconnect: fix mem leak when freeing nodes {CVE-2023-53096}
  - drm/vkms: Fix memory leak in vkms_init() {CVE-2022-50269}
  - USB: dwc3: fix memory leak with using debugfs_lookup() {CVE-2023-53415}
  - mm/uffd: fix pte marker when fork() without fork event {CVE-2022-49744}
  - scsi: qla2xxx: Fix memory leak in qla2x00_probe_one() {CVE-2023-53696}
  - ipmi_si: fix a memleak in try_smi_init() {CVE-2023-53611}
  - KVM: Explicitly verify target vCPU is online in kvm_get_vcpu() {CVE-2024-58083}
  - scsi: lpfc: Release hbalock before calling lpfc_worker_wake_up() {CVE-2024-36924}
  - firmware: cs_dsp: Validate payload length before processing block {CVE-2024-42237}
  - hwmon: (w83792d) Fix NULL pointer dereference by removing unnecessary structure field {CVE-2021-47385}
  - ftrace: Avoid potential division by zero in function_stat_show() {CVE-2025-21898}
  - IB/core: Implement a limit on UMAD receive List {CVE-2024-42145}
  - vfio/pci: Disable auto-enable of exclusive INTx IRQ {CVE-2024-27437}
  - netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type {CVE-2025-23161}
  - net: nexthop: Initialize all fields in dumped nexthops {CVE-2024-42283}
  - tracing: Make sure trace_printk() can output as soon as it can be used {CVE-2023-53007}
  - net: tls: explicitly disallow disconnect {CVE-2025-37756}
  - KVM: x86: Reject Hyper-V's SEND_IPI hypercalls if local APIC isn't in-kernel {CVE-2025-21779}
  - ext4: turn quotas off if mount failed after enabling quotas {CVE-2023-54153}
  - NFC: digital: Bounds check NFC-A cascade depth in SDD response handler {CVE-2026-31622}
  - block: fix overflow in blk_ioctl_discard() {CVE-2024-36917}
  - usb: xhci: Check endpoint is valid before dereferencing it {CVE-2023-52901}
  - iio: core: fix memleak in iio_device_register_sysfs {CVE-2023-52643}
  - platform/x86/amd/pmc: Detect when STB is not available {CVE-2024-53072}
  - mm: memcg: fix NULL pointer in mem_cgroup_track_foreign_dirty_slowpath() {CVE-2023-52939}
  - dm thin: make get_first_thin use rcu-safe list first function {CVE-2025-21664}
  - bus: mhi: host: pci_generic: Use pci_try_reset_function() to avoid deadlock {CVE-2025-21951}
  - bonding: provide a net pointer to __skb_flow_dissect() {CVE-2026-23119}
  - rocker: fix memory leak in rocker_world_port_post_fini() {CVE-2026-23164}
  - rtc: class: Fix potential memleak in devm_rtc_allocate_device() {CVE-2022-50477}
  - ice: fix memory leak in aRFS after reset {CVE-2025-21981}
  - bpf: Forget ranges when refining tnum after JSET {CVE-2025-39748}
  - net: hns: fix possible memory leak in hnae_ae_register() {CVE-2022-50352}
  - team: better TEAM_OPTION_TYPE_STRING validation {CVE-2025-21787}
  - refscale: Fix uninitalized use of wait_queue_head_t {CVE-2023-54316}
  - opp: Fix use-after-free in lazy_opp_tables after probe deferral {CVE-2023-54026}
  - mptcp: cope racing subflow creation in mptcp_rcv_space_adjust {CVE-2024-53122}
  - serial: 8250: fix panic due to PSLVERR {CVE-2025-39724}
  - perf: Fix sample vs do_exit() {CVE-2025-38424}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els7]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role {CVE-2026-46113}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN {CVE-2026-46113}
  - Bluetooth: bcsp: receive data only if registered {CVE-2025-40308}
  - xen/privcmd: unregister xenstore notifier on module exit {CVE-2026-31788}
  - xen/privcmd: restrict usage in unprivileged domU {CVE-2026-31788}
  - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts {CVE-2026-43429}
  - net: usb: rtl8150: enable basic endpoint checking {CVE-2025-21708}
  - net: usb: kaweth: validate USB endpoints {CVE-2026-23312}
  - net: usb: kalmia: validate USB endpoints {CVE-2026-23365}
  - net: usb: pegasus: validate USB endpoints {CVE-2026-23290}
  - net: usb: pegasus: enable basic endpoint checking {CVE-2026-43156}
  - USB: usbcore: Introduce usb_bulk_msg_killable() {CVE-2026-43429}
  - USB: core: Add routines for endpoint checks in old drivers {CVE-2026-43156}
  - nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
  - tpm: Cap the number of PCR banks {CVE-2025-71077}
  - clk: imx: clk-imx8mp: improve error handling in imx8mp_clocks_probe() {CVE-2023-53704}
  - dm: fix a race condition in retrieve_deps {CVE-2023-54324}
  - ice: fix Tx scheduler error handling in XDP callback {CVE-2025-38127}
  - mlx5: fix skb leak while fifo resync and push {CVE-2023-54238}
  - mmc: vub300: fix return value check of mmc_add_host() {CVE-2022-50251}
  - bonding: annotate data-races around slave->last_rx {CVE-2026-23212}
  - RDMA/irdma: Fix data race on CQP completion stats {CVE-2023-54302}
  - bpf: cpumap: Fix memory leak in cpu_map_update_elem {CVE-2023-53441}
  - fbdev: Fix do_register_framebuffer to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38215}
  - trace/fgraph: Fix the warning caused by missing unregister notifier {CVE-2025-39829}
  - vxlan: Fix NPD in {arp,neigh}_reduce() when using nexthop objects {CVE-2025-39850}
  - team: prevent adding a device which is already a team device lower {CVE-2024-58071}
  - net: stmmac: move the EST lock to struct stmmac_priv {CVE-2024-38594}
  - drm/amd/display: Disable PSR-SU on Parade 08-01 TCON too {CVE-2024-50108}
  - rxrpc: Fix handling of received connection abort {CVE-2024-58053}
  - bnxt_en: Fix out-of-bound memcpy() during ethtool -w {CVE-2025-37911}
  - scsi: storvsc: Ratelimit warning logs to prevent VM denial of service {CVE-2025-21690}
  - net: atlantic: Fix DMA mapping for PTP hwts ring {CVE-2024-26680}
  - wifi: mac80211: use two-phase skb reclamation in ieee80211_do_stop() {CVE-2024-47713}
  - drm/amd/display: Add null check for 'afb' in amdgpu_dm_plane_handle_cursor_update (v2) {CVE-2024-49905}
  - dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
  - smb: client: validate the whole DACL before rewriting it in cifsacl {CVE-2026-31709}
  - PM: runtime: Fix a race condition related to device removal {CVE-2026-23452}
  - ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces {CVE-2026-43436}
  - nvme-pci: Fix race bug in nvme_poll_irqdisable() {CVE-2026-43448}
  - sctp: add mutual exclusion in proc_sctp_do_udp_port() {CVE-2025-22062}
  - cachefiles: fix dentry leak in cachefiles_open_file() {CVE-2024-49870}
  - mm: revert "mm: shmem: fix data-race in shmem_getattr()" {CVE-2024-53136}
  - memcg: fix soft lockup in the OOM process {CVE-2024-57977}
  - resource: fix region_intersects() vs add_memory_driver_managed() {CVE-2024-49878}
  - r8169: add tally counter fields added with RTL8125 {CVE-2024-49973}
  - svcrdma: fix miss destroy percpu_counter in svc_rdma_proc_init() {CVE-2024-53215}
  - ext4: fix iloc.bh leak in ext4_fc_replay_inode() error paths {CVE-2026-43066}
  - wifi: rtw88: Use devm_kmemdup() in rtw_set_supported_band() {CVE-2025-71273}
  - net: netlink: af_netlink: Prevent empty skb by adding a check on len. {CVE-2021-47606}
  - extcon: Modify extcon device to be created after driver data is set {CVE-2022-49308}
  - tick/nohz: unexport __init-annotated tick_nohz_full_setup() {CVE-2022-49675}
  - bridge: switchdev: Fix memory leaks when changing VLAN protocol {CVE-2022-49812}
  - capabilities: fix potential memleak on error path from vfs_getxattr_alloc() {CVE-2022-49890}
  - net: genl: fix error path memory leak in policy dumping {CVE-2022-50042}
  - kprobes: don't call disarm_kprobe() for disabled kprobes {CVE-2022-50008}
  - lib/fonts: fix undefined behavior in bit shift for get_default_font {CVE-2022-50511}
  - net: af_key: zero aligned sockaddr tail in PF_KEY exports {CVE-2026-43088}
  - arm64: mte: Avoid setting PG_mte_tagged if no tags cleared or restored {CVE-2022-50675}
  - HID: logitech-hidpp: Fix kernel crash on receiver USB disconnect {CVE-2023-52478}
  - efivarfs: force RO when remounting if SetVariable is not supported {CVE-2023-52463}
  - Fix page corruption caused by racy check in __free_pages {CVE-2023-52739}
  - mptcp: deal with large GSO size {CVE-2023-52778}
  - net: can: j1939: enhanced error handling for tightly received RTS messages in xtp_rx_rts_session_new {CVE-2023-52887}
  - drm/i915/active: Fix misuse of non-idle barriers as fence trackers {CVE-2023-53087}
  - ext4: fix task hung in ext4_xattr_delete_inode {CVE-2023-53089}
  - ACPI: PPTT: Fix to avoid sleep in the atomic context when PPTT is absent {CVE-2023-53070}
  - bnxt_en: Avoid order-5 memory allocation for TPA data {CVE-2023-53134}
  - tcp: tcp_make_synack() can be called from process context {CVE-2023-53121}
  - i40e: Fix kernel crash during reboot when adapter is in recovery mode {CVE-2023-53114}
  - skbuff: Fix a race between coalescing and releasing SKBs {CVE-2023-53186}
  - blk-cgroup: Reinit blkg_iostat_set after clearing in blkcg_reset_stats() {CVE-2023-53421}
  - arm64: mm: fix VA-range sanity check {CVE-2023-53989}
  - ip6_tunnel: fix NEXTHDR_FRAGMENT handling in ip6_tnl_parse_tlv_enc_lim() {CVE-2024-26633}
  - SUNRPC: double free xprt_ctxt while still in use {CVE-2023-54269}
  - KVM: Always flush async #PF workqueue when vCPU is being destroyed {CVE-2024-26976}
  - drm/amdgpu: validate the parameters of bo mapping operations more clearly {CVE-2024-26922}
  - tracing/trigger: Fix to return error if failed to alloc snapshot {CVE-2024-26920}
  - dmaengine: idxd: Fix oops during rmmod on single-CPU platforms {CVE-2024-35989}
  - nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment(). {CVE-2024-36933}
  - firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files {CVE-2024-41056}
  - scsi: qla2xxx: During vport delete send async logout explicitly {CVE-2024-42289}
  - ata: libata-core: fix NULL pointer deref in ata_host_alloc_pinfo() {CVE-2022-49731}
  - ixgbevf: Fix resource leak in ixgbevf_init_module() {CVE-2022-49028}
  - mmc: core: Avoid bitfield RMW for claim/retune flags {CVE-2026-43484}
  - Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_new_connection_cb() {CVE-2026-45835}
  - cpufreq: Init completion before kobject_init_and_add() {CVE-2022-50473}
  - USB: gadget: Fix use-after-free during usb config switch {CVE-2022-50704}
  - IB/mad: Don't call to function that might sleep while in atomic context {CVE-2022-50472}
  - null_blk: fix poll request timeout handling {CVE-2023-53531}
  - drm/i915/gvt: fix vgpu debugfs clean in remove {CVE-2023-53625}
  - mlxsw: spectrum_acl_erp: Fix object nesting warning {CVE-2024-43880}
  - drm/drm_vma_manager: Add drm_vma_node_allow_once() {CVE-2023-53001}
  - drm/amd/display: fix mapping to non-allocated address {CVE-2023-53753}
  - ipv6: Fix an uninit variable access bug in __ip6_make_skb() {CVE-2023-54265}
  - udplite: Fix NULL pointer dereference in __sk_mem_raise_allocated(). {CVE-2023-54004}
  - netlink: terminate outstanding dump on socket close {CVE-2024-53140}
  - KVM: VMX: Bury Intel PT virtualization (guest/host mode) behind CONFIG_BROKEN {CVE-2024-53135}
  - scsi: qla2xxx: Fix use after free on unload {CVE-2024-56623}
  - net: Fix icmp host relookup triggering ip_rt_bug {CVE-2024-56647}
  - spi: spi-imx: Add check for spi_imx_setupxfer() {CVE-2025-37801}
  - netdevsim: fix a race issue related to the operation on bpf_bound_progs list {CVE-2026-23126}
  - net: ipv6: fix panic when IPv4 route references loopback IPv6 nexthop {CVE-2026-23300}
  - ethtool: check device is present when getting link settings {CVE-2024-46679}
  - nfsd: return -EINVAL when namelen is 0 {CVE-2024-47692}
  - x86/ioapic: Handle allocation failures gracefully {CVE-2024-49927}
  - jbd2: stop waiting for space when jbd2_cleanup_journal_tail() returns error {CVE-2024-49959}
  - secretmem: disable memfd_secret() if arch cannot set direct map {CVE-2024-50182}
  - wifi: rtlwifi: Drastically reduce the attempts to read efuse in case of failures {CVE-2024-53190}
  - iommu/arm-smmu: Defer probe of clients after smmu device bound {CVE-2024-56568}
  - RDMA/bnxt_re: Fix the page details for the srq created by kernel consumers {CVE-2025-21885}
  - sound/virtio: Fix cancel_sync warnings on uninitialized work_structs {CVE-2025-37805}
  - page_pool: avoid infinite loop to schedule delayed worker {CVE-2025-37859}
  - netfilter: flowtable: account for Ethernet header in nf_flow_pppoe_proto() {CVE-2025-38441}
  - tracing: Add down_write(trace_event_sem) when adding trace event {CVE-2025-38539}
  - mm/ptdump: take the memory hotplug lock inside ptdump_walk_pgd() {CVE-2025-38681}
  - ipv6: add NULL checks for idev in SRv6 paths {CVE-2026-23442}
  - sunrpc: fix cache_request leak in cache_release {CVE-2026-31400}
  - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP {CVE-2026-31424}
  - netfilter: xt_multiport: validate range encoding in checkentry {CVE-2026-31681}
  - net: sched: act_csum: validate nested VLAN headers {CVE-2026-31684}
  - vxlan: validate ND option lengths in vxlan_na_create {CVE-2026-31738}
  - gfs2: fiemap page fault fix {CVE-2026-43262}
  - e1000/e1000e: Fix leak in DMA error cleanup {CVE-2026-43445}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing {CVE-2026-43279}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els8]
changelog:
  - gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
  - ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
  - KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
  - Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
  - xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
  - sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
  - blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
  - net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
  - gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
  - HID: betop: check shape of output reports {CVE-2023-53015}
  - mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
  - HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
  - drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
  - ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
  - RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
  - Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
  - scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
  - sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
  - pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
  - cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
  - ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
  - nbd: don't allow reconnect after disconnect {CVE-2025-21731}
  - openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
  - ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
  - ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
  - net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
  - wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
  - ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
  - i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
  - net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
  - bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
  - xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
  - firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
  - virtgpu: don't reset on shutdown {CVE-2025-38064}
  - xen/netfront: fix crash when removing device {CVE-2022-48969}
  - mptcp: do not fallback when OoO is present {CVE-2024-50185}
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
  - xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
  - ext4: fix racy may inline data check in dio write {CVE-2023-52786}
  - drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
  - macsec: fix UAF bug for real_dev {CVE-2022-49390}
  - drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
  - mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
  - driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
  - udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
  - ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
  - mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
  - eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
  - net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
  - udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
  - RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
  - dlm: fix possible lkb_resource null dereference {CVE-2024-47809}
  - ACPI: battery: Fix possible crash when unregistering a battery hook {CVE-2024-49955}
  - ASoC: SOF: Intel: hda-dai: Ensure DAI widget is valid during params {CVE-2024-58012}
  - tpm: Change to kvalloc() in eventlog/acpi.c {CVE-2024-58005}
  - net_sched: sch_sfq: move the limit validation {CVE-2025-37752}
  - usb: xhci: Fix NULL pointer dereference on certain command aborts {CVE-2024-57981}
  - mm/migrate_device: don't add folio to be freed to LRU in migrate_device_finalize() {CVE-2025-21861}
  - bpf: avoid holding freeze_mutex during mmap operation {CVE-2025-21853}
  - acct: perform last write from workqueue {CVE-2025-21846}
  - netfilter: nf_conncount: Fully initialize struct nf_conncount_tuple in insert_tree() {CVE-2025-21959}
  - ipvlan: ensure network headers are in skb linear part {CVE-2025-21891}
  - wifi: iwlwifi: mvm: fix 6 GHz scan construction {CVE-2024-53055}
  - signal: restore the override_rlimit logic {CVE-2024-50271}
  - thermal: core: Reference count the zone in thermal_zone_get_by_id() {CVE-2024-50028}
  - block: fix potential invalid pointer dereference in blk_add_partition {CVE-2024-47705}
  - userfaultfd: fix checks for huge PMDs {CVE-2024-46787}
  - mptcp: pm: only mark 'subflow' endp as available {CVE-2024-45010}
  - mptcp: pm: re-using ID of unused flushed subflows {CVE-2024-45010}
  - eth: bnxt: fix truesize for mb-xdp-pass case {CVE-2025-21961}
  - driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
  - virtio_net: Fix napi_skb_cache_put warning {CVE-2024-43835}
  - cgroup: fix race between task migration and iteration {CVE-2026-43439}
  - bpf: Fix wrong reg type conversion in release_reference() {CVE-2022-49873}
  - RDMA/mlx5: Fix a race for an ODP MR which leads to CQE with error {CVE-2025-21732}
  - serial: core: fix infinite loop in handle_tx() for PORT_UNKNOWN {CVE-2026-23472}
  - drm/amdgpu: Limit BO list entry count to prevent resource exhaustion {CVE-2026-23468}
  - net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
  - tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
  - RDMA/mlx5: Fix a WARN during dereg_mr for DM type {CVE-2025-21888}
  - list: fix a data-race around ep->rdllist {CVE-2022-49443}
  - can: isotp: sanitize CAN ID checks in isotp_bind() {CVE-2022-49269}
  - rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
  - sched/rt: Fix race in push_rt_task {CVE-2025-38234}
  - NFSD: fix race between nfsd registration and exports_proc {CVE-2025-38232}
  - virtio: break and reset virtio devices on device_shutdown() {CVE-2025-38064}
  - block: fix resource leak in blk_register_queue() error path {CVE-2025-37980}
  - xsk: Fix race condition in AF_XDP generic RX path {CVE-2025-37920}
  - mm/vmscan: don't try to reclaim hwpoison folio {CVE-2025-37834}
  - nouveau: offload fence uevents work to workqueue {CVE-2024-26719}
  - bpf: Fix kmemleak warning for percpu hashmap {CVE-2025-37807}
  - x86/mm: Disallow vsyscall page read for copy_from_kernel_nofault() {CVE-2024-26906}
  - x86/mm: Move is_vsyscall_vaddr() into asm/vsyscall.h {CVE-2024-26906}
  - net, sunrpc: Remap EPERM in case of connection failure in xs_tcp_setup_socket {CVE-2024-42246}
  - quota: Fix potential NULL pointer dereference {CVE-2024-26878}
  - arp: Prevent overflow in arp_req_get(). {CVE-2024-26733}
  - ALSA: Fix deadlocks with kctl removals at disconnection {CVE-2024-38600}
  - wifi: cfg80211: restrict NL80211_ATTR_TXQ_QUANTUM values {CVE-2024-42114}
  - Bluetooth: hci_core: cancel all works upon hci_unregister_dev() {CVE-2024-41063}
  - fsnotify: clear PARENT_WATCHED flags lazily {CVE-2024-47660}
  - mm: use memalloc_nofs_save() in page_cache_ra_order() {CVE-2024-36882}
  - mm/memory-failure: fix deadlock when hugetlb_optimize_vmemmap is enabled {CVE-2024-26987}
  - net: esp: fix bad handling of pages from page_pool {CVE-2024-26953}
  - virtio/vsock: Fix accept_queue memory leak {CVE-2024-53119}
  - netfilter: nft_payload: sanitize offset and length before calling skb_checksum() {CVE-2024-50251}
  - fs/proc: fix softlockup in __read_vmcore (part 2) {CVE-2025-21694}
  - drm/i915/hdcp: Add encoder check in intel_hdcp_get_capability {CVE-2024-53051}
  - net: Fix null-ptr-deref by sock_lock_init_class_and_name() and rmmod. {CVE-2025-23143}
  - x86/mm/pat: Fix VM_PAT handling when fork() fails in copy_page_range() {CVE-2025-22090}
  - net: decrease cached dst counters in dst_release {CVE-2025-22057}
  - nfsd: put dl_stid if fail to queue dl_recall {CVE-2025-22025}
  - nfsd: make nfsd4_run_cb a bool return function {CVE-2025-22025}
  - usb: gadget: core: flush gadget workqueue after device removal {CVE-2025-21838}
  - PCI: Avoid putting some root ports into D3 on TUXEDO Sirius Gen1 {CVE-2025-21831}
  - media: uvcvideo: Fix crash during unbind if gpio unit is in use {CVE-2024-58079}
  - usb: typec: tcpm: Fix NULL pointer dereference in tcpm_pd_svdm() {CVE-2023-52877}
  - ext4: filesystems without casefold feature cannot be mounted with siphash {CVE-2024-49968}
  - padata: use integer wrap around to prevent deadlock on seq_nr overflow {CVE-2024-47739}
  - bpf, lsm: Add check for BPF LSM return value {CVE-2024-47703}
  - sched/smt: Fix unbalance sched_smt_present dec/inc {CVE-2024-44958}
  - xen-netfront: Fix NULL sring after live migration {CVE-2022-48969}
  - dlm: prevent NPD when writing a positive value to event_done {CVE-2025-23131}
  - udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
  - bpf: sync_linked_regs() must preserve subreg_def {CVE-2024-53125}
  - mptcp: handle consistently DSS corruption {CVE-2024-50185}
  - null_blk: fix null-ptr-dereference while configuring 'power' and 'submit_queues' {CVE-2024-36478}
  - net: tunnels: annotate lockless accesses to dev->needed_headroom {CVE-2023-53109}
  - net/mlx5e: Avoid WARN_ON when configuring MQPRIO with HTB offload enabled {CVE-2025-38039}
  - uprobes: Reject the shared zeropage in uprobe_write_opcode() {CVE-2025-21881}
  - mm: slub: avoid wake up kswapd in set_track_prepare {CVE-2025-39843}
  - mm/smaps: fix race between smaps_hugetlb_range and migration {CVE-2025-39754}
  - bpf: Reject narrower access to pointer ctx fields {CVE-2025-38591}
  - net: clear the dst when changing skb protocol {CVE-2025-38192}
  - backlight: led_bl: Hold led_access lock when calling led_sysfs_disable() {CVE-2025-23144}
  - RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
  - can: j1939: implement NETDEV_UNREGISTER notification handler {CVE-2025-39925}
  - net: Remove RTNL dance for SIOCBRADDIF and SIOCBRDELIF. {CVE-2025-22111}
  - vxlan: Fix NPD when refreshing an FDB entry with a nexthop object {CVE-2025-39851}
  - loop: Avoid updating block size under exclusive owner {CVE-2025-38709}
  - wifi: cfg80211: Add missing lock in cfg80211_check_and_end_cac() {CVE-2025-38643}
  - net_sched: sch_sfq: reject invalid perturb period {CVE-2025-38193}
  - net: phy: mscc: Fix memory leak when using one step timestamping {CVE-2025-38148}
  - espintcp: remove encap socket caching to avoid reference leak {CVE-2025-38097}
  - rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
  - serial: mctrl_gpio: split disable_ms into sync and no_sync APIs {CVE-2025-38040}
  - usb: typec: ucsi: displayport: Fix deadlock {CVE-2025-37967}
  - ipvs: fix uninit-value for saddr in do_output_route4 {CVE-2025-37961}
  - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
  - bpf: Scrub packet on bpf_redirect_peer {CVE-2025-37959}
  - tracing: Verify event formats that have "%*p.." {CVE-2025-37938}
  - iommu/amd/pgtbl: Fix possible race while increase page table level {CVE-2025-39961}
  - net/mlx5e: Harden uplink netdev access against device unbind {CVE-2025-39947}
  - dm-stripe: fix a possible integer overflow {CVE-2025-39940}
  - net: rfkill: gpio: Fix crash due to dereferencering uninitialized pointer {CVE-2025-39937}
  - can: netlink: can_changelink(): fix NULL pointer deref of struct can_priv::do_set_mode {CVE-2025-38665}
  - net/mlx5e: Fix crash on profile change rollback failure {CVE-2026-23000}
  - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
  - tracing: Add recursion protection in kernel stack trace recording {CVE-2026-23138}
  - rxrpc: Fix recvmsg() unconditional requeue {CVE-2026-23066}
  - net: can: j1939: j1939_xtp_rx_rts_session_active(): deactivate session upon receiving the second rts {CVE-2026-22997}
  - net: can: j1939: recover socket queue on CAN bus error during BAM transmission {CVE-2026-22997}
  - dm-verity: disable recursive forward error correction {CVE-2025-71161}
  - netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
  - KEYS: trusted: Fix a memory leak in tpm2_load_cmd {CVE-2025-71147}
  - vsock/virtio: fix potential underflow in virtio_transport_get_credit() {CVE-2026-23069}
  - net: fix segmentation of forwarding fraglist GRO {CVE-2026-23154}
  - ice: Don't process extts if PTP is disabled {CVE-2024-42107}
  - drm/i915/dpt: Make DPT object unshrinkable {CVE-2024-40924}
  - drm/i915/dpt: Treat the DPT BO as a framebuffer {CVE-2024-40924}
  - bpf: Add sk_is_inet and IS_ICSK check in tls_sw_has_ctx_tx/rx {CVE-2024-53091}
  - pipe: wakeup wr_wait after setting max_usage {CVE-2023-52672}
  - bonding: restore bond's IFF_SLAVE flag if a non-eth dev enslave fails {CVE-2023-53103}
  - HID: hid-thrustmaster: Fix warning in thrustmaster_probe by adding endpoint check {CVE-2024-57993}
  - drm/amdkfd: debugfs hang_hws skip GPU with MES {CVE-2025-37853}
  - leds: mlxreg: Use devm_mutex_init() for mutex initialization {CVE-2024-42129}
  - drm/amd/display: fix a Null pointer dereference vulnerability {CVE-2025-39705}
  - gfs2: Validate i_depth for exhash directories {CVE-2025-38710}
  - drm/scheduler: signal scheduled fence when kill job {CVE-2025-38436}
  - drm/amdgpu: Add basic validation for RAS header {CVE-2025-38426}
  - mptcp: fix NULL pointer in can_accept_new_subflow {CVE-2025-23145}
  - bpf: bpf_sk_storage: Fix invalid wait context lockdep report {CVE-2023-53857}
  - nvme-core: fix memory leak in dhchap_secret_store {CVE-2023-53852}
  - virtio_net: Fix error unwinding of XDP initialization {CVE-2023-53499}
  - nvme-core: fix memory leak in dhchap_ctrl_secret {CVE-2023-53792}
  - ceph: fix race condition validating r_parent before applying state {CVE-2025-39927}
  - x86/MCE: Always save CS register on AMD Zen IF Poison errors {CVE-2023-53438}
  - genirq/ipi: Fix NULL pointer deref in irq_data_get_affinity_mask() {CVE-2023-53332}
  - nfsd: move init of percpu reply_cache_stats counters back to nfsd_init_net {CVE-2023-54276}
  - blk-cgroup: Fix NULL deref caused by blkg_policy_data being installed before init {CVE-2023-54271}
  - net/mlx5e: TC, Fix internal port memory leak {CVE-2023-53999}
  - tipc: do not update mtu if msg_max is too small in mtu negotiation {CVE-2023-53517}
  - tipc: add tipc_bearer_min_mtu to calculate min mtu {CVE-2023-53517}
  - tun: Fix memory leak for detached NAPI queue. {CVE-2023-53685}
  - net: cdc_ncm: Deal with too low values of dwNtbOutMaxSize {CVE-2023-53667}
  - start_kernel: Add __no_stack_protector function attribute {CVE-2023-53491}
  - net: usbnet: Fix WARNING in usbnet_start_xmit/usb_submit_urb {CVE-2023-53548}
  - sched/psi: use kernfs polling functions for PSI trigger polling {CVE-2023-54019}
  - cxl/pmem: Fix nvdimm registration races {CVE-2023-54323}
  - drm/radeon: delete radeon_fence_process in is_signaled, no deadlock {CVE-2025-68223}
  - dst: fix races in rt6_uncached_list_del() and rt_del_uncached_list() {CVE-2026-23004}
  - wifi: mac80211: don't WARN for connections on invalid channels {CVE-2025-71227}
  - md: suspend array while updating raid_disks via sysfs {CVE-2025-71225}
  - net: stmmac: fix the crash issue for zero copy XDP_TX action {CVE-2025-71095}
  - drm/ttm: Don't leak a resource on eviction error {CVE-2023-54254}
  - firmware: arm_sdei: Fix sleep from invalid context BUG {CVE-2023-54160}
  - iommu/amd: Add a length limitation for the ivrs_acpihid command-line parameter {CVE-2023-54057}
  - net: usb: asix: validate PHY address before use {CVE-2025-71094}
  - tty: fix deadlock caused by calling printk() under tty_port->lock {CVE-2022-49441}
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE {CVE-2026-23401}
  - blktrace: fix __this_cpu_read/write in preemptible context {CVE-2026-23374}
  - x86/CPU: Fix FPDSS on Zen1 {CVE-2025-54505}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild {CVE-2026-23210}
  - mptcp: fix race in mptcp_pm_nl_flush_addrs_doit() {CVE-2026-23169}
  - gfs2: No more self recovery {CVE-2025-38659}
  - tracing: kprobe: Fix memory leak in test_gen_kprobe/kretprobe_cmd() {CVE-2022-49891}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_array in kprobe_event_gen_test_exit() {CVE-2022-49796}
  - tracing: kprobe: Fix potential null-ptr-deref on trace_event_file in kprobe_event_gen_test_exit() {CVE-2022-49797}
  - netlink: Bounds-check struct nlmsgerr creation {CVE-2022-49766}
  - bpf: Prevent bpf program recursion for raw tracepoint probes {CVE-2022-49764}
  - i2c: designware: use casting of u64 in clock multiplication to avoid overflow {CVE-2022-49749}
  - futex: Clear stale exiting pointer in futex_lock_pi() retry path {CVE-2026-31555}
  - ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop() {CVE-2026-31531}
  - netfilter: ctnetlink: use netlink policy range checks {CVE-2026-31495}
  - tracing: Fix potential deadlock in cpu hotplug with osnoise {CVE-2026-31480}
  - esp: fix skb leak with espintcp and async crypto {CVE-2026-31518}
  - xfs: factor out xfs_attr3_leaf_init {CVE-2026-43053}
  - xfs: factor out xfs_attr3_node_entry_remove {CVE-2026-43053}
  - ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
  - bridge: br_nd_send: validate ND option lengths {CVE-2026-31752}
  - rtnetlink: add missing netlink_ns_capable() check for peer netns {CVE-2026-31692}
  - crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
  - APEI/GHES: ensure that won't go past CPER allocated record {CVE-2026-43277}
  - ceph: supply snapshot context in ceph_zero_partial_object() {CVE-2026-43273}
  - team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
  - wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() {CVE-2025-71297}
  - EFI/CPER: don't go past the ARM processor CPER record buffer {CVE-2026-43266}
  - net: bridge: switchdev: Skip MDB replays of deferred events on offload {CVE-2024-26837}
  - can: mcp251xfd: fix infinite loop when xmit fails {CVE-2024-41088}
  - ipvlan: Make the addrs_lock be per port {CVE-2026-23103}
  - netem: fix return value if duplicate enqueue fails {CVE-2024-45016}
  - USB: serial: mos7840: fix crash on resume {CVE-2024-42244}
  - crypto: null - Use spin lock instead of mutex {CVE-2025-37808}
  - RDMA/core: Check for the presence of LS_NLA_TYPE_DGID correctly {CVE-2025-71096}
  - bpf: Fix overrunning reservations in ringbuf {CVE-2024-41009}
  - bpf: Fix bpf_sk_select_reuseport() memory leak {CVE-2025-21683}
  - drm/i915: Fix request ref counting during error capture & debugfs dump {CVE-2023-52981}
  - netfilter: conntrack: fix wrong ct->timeout value {CVE-2023-53635}
  - drop_monitor: replace spin_lock by raw_spin_lock {CVE-2024-40980}
  - net: bonding: fix NULL deref in bond_debug_rlb_hash_show {CVE-2026-31546}
  - serial: protect uart_port_dtr_rts() in uart_shutdown() too {CVE-2024-50058}
  - wifi: mac80211: Fix static_branch_dec() underflow for aql_disable. {CVE-2026-31551}
  - ipv6: Fix signed integer overflow in __ip6_append_data {CVE-2022-49728}
  - selinux: avoid dereference of garbage after mount failure {CVE-2024-35904}
  - fs/inode: Prevent dump_mapping() accessing invalid dentry.d_name.name {CVE-2024-49934}
  - tracing: Do not let histogram values have some modifiers {CVE-2023-53093}
  - ice: Add netif_device_attach/detach into PF reset flow {CVE-2024-46770}
  - bpf: Fix deadlock between rcu_tasks_trace and event_mutex. {CVE-2025-37884}
  - fbmon: prevent division by zero in fb_videomode_from_videomode() {CVE-2024-35922}
  - drm/amdgpu: Fix the null pointer dereference to ras_manager {CVE-2024-43908}
  - tracing: Ensure visibility when inserting an element into tracing_map {CVE-2024-26645}
  - drm/amd/display: Add null check for set_output_gamma in dcn30_set_output_transfer_func {CVE-2024-47720}
  - phy: mdio: fix memory leak {CVE-2021-47416}
  - ipv4: Fix reference count leak when using error routes with nexthop objects {CVE-2025-71097}
  - NFSv4: Prevent NULL-pointer dereference in nfs42_complete_copies() {CVE-2024-50046}
  - packet: annotate data-races around ignore_outgoing {CVE-2024-26862}
  - md: fix resync softlockup when bitmap size is less than array size {CVE-2024-38598}
  - wireguard: receive: annotate data-race around receiving_counter.counter {CVE-2024-26861}
  - netfs: Only call folio_start_fscache() one time for each folio {CVE-2023-52582}
  - usb: xhci: tegra: fix sleep in atomic call {CVE-2023-53475}
  - ACPI: PAD: fix crash in exit_round_robin() {CVE-2024-49935}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() {CVE-2026-43499}
  - netfilter: nf_reject_ipv6: fix potential crash in nf_send_reset6() {CVE-2024-50256}
  - Bluetooth: ISO: Fix multiple init when debugfs is disabled {CVE-2024-50077}
  - hwpoison, memory_hotplug: lock folio before unmap hwpoisoned folio {CVE-2025-21931}
  - RDMA/core: Silence oversized kvmalloc() warning {CVE-2025-37867}
  - tipc: Check the bearer type before calling tipc_udp_nl_bearer_add() {CVE-2024-26663}
  - net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
  - net: mdio: fix unbalanced fwnode reference count in mdio_device_release() {CVE-2022-48961}
  - eth: alx: take rtnl_lock on resume {CVE-2022-50498}
  - ata: libata-transport: fix error handling in ata_tlink_add() {CVE-2022-49824}
  - ata: libata-transport: fix error handling in ata_tport_add() {CVE-2022-49825}
  - netfilter: br_netfilter: fix panic with metadata_dst skb {CVE-2024-50045}
  - net: fix NULL pointer in skb_segment_list {CVE-2023-52991}
  - hv_netvsc: Fix race condition between netvsc_probe and netvsc_remove {CVE-2024-26698}
  - scsi: qla2xxx: validate nvme_local_port correctly {CVE-2024-42286}
  - rcu/rcuscale: Stop kfree_scale_thread thread(s) after unloading rcuscale {CVE-2023-53291}
  - wifi: mac80211: Discard Beacon frames to non-broadcast address {CVE-2025-71127}
  - wifi: mwifiex: Do not return unused priv in mwifiex_get_priv_by_id() {CVE-2024-46755}
  - sctp: sysctl: cookie_hmac_alg: avoid using current->nsproxy {CVE-2025-21640}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_hd_modes {CVE-2024-41089}
  - tipc: Change nla_policy for bearer-related names to NLA_NUL_STRING {CVE-2023-52845}
  - bpf, sockmap: Reject sk_msg egress redirects to non-TCP sockets {CVE-2023-52523}
  - Bluetooth: Fix not cleanup led when bt_init fails {CVE-2022-48971}
  - netfilter: nf_conntrack_h323: Add protection for bmp length out of range {CVE-2024-26851}
  - ipvs: fix UB due to uninitialized stack access in ip_vs_protocol_init() {CVE-2024-53680}
  - ppp_async: limit MRU to 64K {CVE-2024-26675}
  - USB: class: cdc-wdm: Fix CPU lockup caused by excessive log messages {CVE-2024-40904}
  - ipv6: mcast: fix data-race in ipv6_mc_down / mld_ifc_work {CVE-2024-26631}
  - xfrm: fix one more kernel-infoleak in algo dumping {CVE-2024-50110}
  - xdp: fix invalid wait context of page_pool_destroy() {CVE-2024-43834}
  - fs/netfs/fscache_cookie: add missing "n_accesses" check {CVE-2024-45000}
  - mac802154: check local interfaces before deleting sdata list {CVE-2024-57948}
  - usbnet: gl620a: fix endpoint checking in genelink_bind() {CVE-2025-21877}
  - IB/core: Fix ib_cache_setup_one error flow cleanup {CVE-2024-47693}
  - can: j1939: fix errant WARN_ON_ONCE in j1939_session_deactivate {CVE-2021-4454}
  - vfs: fix race between evice_inodes() and find_inode()&iput() {CVE-2024-47679}
  - scsi: storvsc: Fix handling of virtual Fibre Channel timeouts {CVE-2023-53245}
  - iavf: fix off-by-one issues in iavf_config_rss_reg() {CVE-2025-71087}
  - cachefiles: fix memory leak in cachefiles_add_cache() {CVE-2024-26840}
  - ext4: fix access to uninitialised lock in fc replay path {CVE-2024-50014}
  - net: hns3: fix kernel crash when 1588 is sent on HIP08 devices {CVE-2025-21649}
  - ftrace: Fix regression with module command in stack_trace_filter {CVE-2024-56569}
  - ipv6: sr: fix invalid unregister error path {CVE-2024-38612}
  - crypto: pcrypt - Fix handling of MAY_BACKLOG requests {CVE-2026-43493}
  - netfilter: flowtable: strictly check for maximum number of actions {CVE-2026-43329}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() {CVE-2026-43038}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els9]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK
  - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). {CVE-2025-40149}
  - mpls: Use in6_dev_rcu() and dev_net_rcu() in mpls_forward() and mpls_xmit().
  - net: l3mdev: use skb_dst_dev_rcu() in l3mdev_l3_out()
  - ipv4: start using dst_dev_rcu()
  - tcp: use dst_dev_rcu() in tcp_fastopen_active_disable_ofo_check() {CVE-2025-68188}
  - tcp_metrics: use dst_dev_net_rcu() {CVE-2025-40075}
  - net: use dst_dev_rcu() in sk_setup_caps() {CVE-2025-40170}
  - udp6: Fix race condition in udp6_sendmsg & connect
  - ipv6: use RCU in ip6_output() {CVE-2025-40158}
  - ipv6: use RCU in ip6_xmit() {CVE-2025-40135}
  - ipv6: start using dst_dev_rcu()
  - net: dst: introduce dst->dev_rcu
  - neighbour: accept plain RCU readers in ___neigh_lookup_noref() {CVE-2025-40158}
  - net: Add locking to protect skb->dev access in ip_output
  - ipv6: adopt skb_dst_dev() and skb_dst_dev_net[_rcu]() helpers
  - ipv6: adopt dst_dev() helper
  - ipv4: adopt dst_dev, skb_dst_dev and skb_dst_dev_net[_rcu]
  - net: dst: add four helpers to annotate data-races around dst->dev
  - tcp: convert to dev_net_rcu()
  - tcp: fix potential race in tcp_v6_syn_recv_sock() {CVE-2026-43198}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els10]
changelog:
  - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available {CVE-2026-64561}
  - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level {CVE-2026-63807}
  - Input: uinput - zero-initialize uinput_ff_upload_compat to avoid info leak {CVE-2025-40035}
  - thunderbolt: Limit XDomain response copy to actual frame size {CVE-2026-53146}
  - drm/gud: Fix UBSAN warning {CVE-2022-50628}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}
  - scsi: qla2xxx: Fix DMA-API call trace on NVMe LS requests {CVE-2023-54108}
  - fs: udf: fix OOB read in lengthAllocDescs handling {CVE-2025-40044}
  - tipc: Fix use-after-free in tipc_mon_reinit_self(). {CVE-2025-40280}
  - isofs: Fix out of bound access for corrupted isofs image {CVE-2021-47478}
  - pppoe: drop PFC frames {CVE-2026-53003}
  - nvmet: avoid recursive nvmet-wq flush in nvmet_ctrl_free {CVE-2026-46304}
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery {CVE-2026-43466}
  - scsi: sd: fix missing put_disk() when device_add(&disk_dev) fails {CVE-2026-45997}
  - irqchip/gic-v3: Fix error handling in gic_populate_ppi_partitions {CVE-2022-49716}
  - drm/nouveau: fix u32 overflow in pushbuf reloc bounds check {CVE-2026-46006}
  - can: dev: can_set_termination(): allow sleeping GPIOs {CVE-2024-56625}
  - cxl/mem: Fix shutdown order {CVE-2023-52849}
  - pinctrl: check the return value of pinmux_ops::get_function_name() {CVE-2025-40030}
  - usb: usbtmc: Flush anchored URBs in usbtmc_release {CVE-2026-31758}
  - RDMA/siw: Fix potential NULL pointer dereference in header processing {CVE-2026-23242}
  - ASoC: wm_adsp: Fix NULL dereference when removing firmware controls {CVE-2026-53350}
  - net: bcmgenet: fix off-by-one in bcmgenet_put_txcb {CVE-2026-53088}
  - HID: multitouch: Check to ensure report responses match the request {CVE-2026-43047}
  - can: ems_usb: ems_usb_read_bulk_callback(): fix URB memory leak {CVE-2026-23058}
  - firmware: dmi-sysfs: Fix null-ptr-deref in dmi_sysfs_register_handle {CVE-2023-53250}
  - usb: storage: Fix memory leak in USB bulk transport {CVE-2025-68288}
  - wifi: rtw88: check for PCI upstream bridge existence {CVE-2026-46092}
  - crypto: ccp: Don't attempt to copy ID to userspace if PSP command failed {CVE-2026-31697}
  - scsi: qla2xxx: Fix memory leak in __qlt_24xx_handle_abts() {CVE-2022-48650}
  - HID: apple: avoid memory leak in apple_report_fixup() {CVE-2026-31520}
  - HID: magicmouse: avoid memory leak in magicmouse_report_fixup() {CVE-2026-31522}
  - scsi: qla2xxx: Avoid fcport pointer dereference {CVE-2023-53603}
  - RDMA/mlx4: Fix resource leak on error in mlx4_ib_create_srq() {CVE-2026-46178}
  - scsi: mpi3mr: Add NULL checks when resetting request and reply queues {CVE-2026-43473}
  - HID: roccat: fix use-after-free in roccat_report_event {CVE-2026-43111}
  - tap: free page on error paths in tap_get_user_xdp() {CVE-2026-46320}
  - net: usb: kaweth: remove TX queue manipulation in kaweth_set_rx_mode {CVE-2026-43180}
  - usb: xhci: Fix memory leak in xhci_disable_slot() {CVE-2026-43432}
  - PCI: Fix reset_method_store() memory leak {CVE-2024-56745}
  - rbd: fix null-ptr-deref when device_add_disk() fails {CVE-2026-46079}
  - net: stmmac: fix integer underflow in chain mode {CVE-2026-31649}
  - be2net: pass wrb_params in case of OS2BMC {CVE-2025-40264}
  - thunderbolt: Validate XDomain request packet size before type cast {CVE-2026-53147}
  - Input: uinput - fix circular locking dependency with ff-core {CVE-2026-31667}
  - usb: dwc2: fix possible NULL pointer dereference caused by driver concurrency {CVE-2023-52855}
  - nbd: defer config put in recv_work {CVE-2025-68372}
  - net: hns3: using the num_tqps in the vf driver to apply for resources {CVE-2025-71064}
  - serial: imx: fix tx statemachine deadlock {CVE-2023-52456}
  - bonding: Fix unnecessary warnings and logs from bond_xdp_get_xmit_slave() {CVE-2024-47734}
  - dm-thin: fix metadata refcount underflow {CVE-2026-46107}
  - net: mana: fix use-after-free in mana_hwc_destroy_channel() by reordering teardown {CVE-2026-23454}
  - usb: atm: cxacru: fix a flaw in existing endpoint checks {CVE-2025-21916}
  - md/raid5: validate payload size before accessing journal metadata {CVE-2026-46070}
  - wifi: rtw89: fix potential race condition between napi_init and napi_enable {CVE-2023-53452}
  - ubi: Fix race condition between ctrl_cdev_ioctl and ubi_cdev_ioctl {CVE-2021-47634}
  - ubi: ubi_create_volume: Fix use-after-free when volume creation failed {CVE-2022-49388}
  - virtio_net: Fix UAF on dst_ops when IFF_XMIT_DST_RELEASE is cleared and napi_tx is false {CVE-2026-31469}
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd {CVE-2025-40275}
  - ACPI: CPPC: Fix NULL pointer dereference when nosmp is used {CVE-2025-38113}
  - ACPI: video: Fix use-after-free in acpi_video_switch_brightness() {CVE-2025-40211}
  - ACPICA: Fix NULL pointer dereference in acpi_ev_address_space_dispatch() {CVE-2026-45982}
  - libceph: define and enforce CEPH_MAX_KEY_LEN {CVE-2026-43304}
  - ACPI: pfr_update: Fix the driver update version check {CVE-2025-39701}
  - spi: imx: fix use-after-free on unbind {CVE-2026-45996}
  - Bluetooth: bnep: reject short frames before parsing {CVE-2026-53253}
  - ext4: fix bounds check in check_xattrs() to prevent out-of-bounds access {CVE-2026-46094}
  - xdp: produce a warning when calculated tailroom is negative {CVE-2026-23343}
  - vdpa: Add max vqp attr to vdpa_nl_policy for nlattr length check {CVE-2023-53543}
  - iomap: iomap: fix memory corruption when recording errors during writeback {CVE-2022-50406}
  - topology: Keep the cpumask unchanged when printing cpumap {CVE-2024-57917}
  - Bluetooth: MGMT: Fix list corruption and UAF in command complete handlers {CVE-2026-43059}
  - Bluetooth: vhci: Prevent use-after-free by removing debugfs files early {CVE-2025-39861}
  - Bluetooth: hci_sync: fix double free in 'hci_discovery_filter_clear()' {CVE-2025-38593}
  - mm/damon/sysfs: fix use-after-free in state_show() {CVE-2025-39877}
  - KVM: nSVM: Always use vmcb01 in VMLOAD/VMSAVE emulation {CVE-2026-43133}
  - Bluetooth: SMP: force responder MITM requirements before building the pairing response {CVE-2026-43334}
  - Bluetooth: Fix use-after-free in l2cap_sock_cleanup_listen() {CVE-2025-39860}
  - scsi: megaraid_sas: Fix invalid node index {CVE-2025-38239}
  - mlxsw: core_linecards: Fix double memory deallocation in case of invalid INI file {CVE-2024-42138}
  - kdb: Fix buffer overflow during tab-complete {CVE-2024-39480}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_choice() {CVE-2026-43233}
  - bpf: Fix stack-out-of-bounds write in devmap {CVE-2026-23359}
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() {CVE-2025-39776}
  - netfilter: nft_set_pipapo_avx2: don't return non-matching entry on expiry {CVE-2026-43114}
  - gve: Account for stopped queues when reading NIC stats {CVE-2024-42162}
  - gve: Fix stats report corruption on queue count change {CVE-2026-23262}
  - amba: use generic driver_override infrastructure
  - Drivers: hv: vmbus: use generic driver_override infrastructure
  - vdpa: use generic driver_override infrastructure {CVE-2026-53118}
  - PCI: use generic driver_override infrastructure {CVE-2026-53120}
  - spi: use generic driver_override infrastructure {CVE-2026-31487}
  - driver core: platform: use generic driver_override infrastructure {CVE-2026-31527}
  - driver core: generalize driver_override in struct device {CVE-2026-31688}
  - arm64: topology: fix possible overflow in amu_fie_setup() {CVE-2022-48657}
  - nfs4_setup_readdir(): insufficient locking for ->d_parent->d_inode dereferencing {CVE-2025-68185}
  - NFSD: Fix crash in nfsd4_read_release() {CVE-2025-40324}
  - rxrpc: Fix key reference count leak from call->key {CVE-2026-31639}
  - rxrpc: Only put the call ref if one was acquired {CVE-2026-31638}
  - bpf: Set run context for rawtp test_run callback {CVE-2024-40908}
  - ethtool: Fix uninitialized number of lanes {CVE-2023-53798}
  - xsk: fix refcount underflow in error path {CVE-2023-53698}
  - net: sched: avoid qdisc_reset_all_tx_gt() vs dequeue race for lockless qdiscs {CVE-2026-23340}
  - net: fix fanout UAF in packet_release() via NETDEV_UP race {CVE-2026-31504}
  - net: avoid race between device unregistration and ethnl ops {CVE-2025-21701}
  - net: sched: Disallow replacing of child qdisc from one parent to another {CVE-2025-21700}
  - libceph: Fix potential out-of-bounds access in osdmap_decode() {CVE-2026-52958}
  - libceph: Prevent potential null-ptr-deref in ceph_handle_auth_reply() {CVE-2026-46024}
  - libceph: handle rbtree insertion error in decode_choose_args() {CVE-2026-52954}
  - wifi: mac80211: ocb: skip rx_no_sta when interface is not joined {CVE-2025-71224}
  - wifi: mac80211: prohibit deactivating all links {CVE-2024-58061}
  - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_remote_name() {CVE-2025-21937}
  - Bluetooth: SMP: derive legacy responder STK authentication from MITM state {CVE-2026-31773}
  - Bluetooth: Add check for mgmt_alloc_skb() in mgmt_device_connected() {CVE-2025-21936}
  - Bluetooth: fix memory leak in error path of hci_alloc_dev() {CVE-2026-53252}
  - netfilter: nf_tables: unconditionally flush pending work before notifier {CVE-2024-42109}
  - netfilter: br_netfilter: do not check confirmed bit in br_nf_local_in() after confirm {CVE-2025-39894}
  - netfilter: nf_conntrack_h323: fix OOB read in decode_int() CONS case {CVE-2026-23456}
  - iavf: Fix out-of-bounds when setting channels on remove {CVE-2023-53659}
  - ipv6: prevent possible UaF in addrconf_permanent_addr() {CVE-2026-43339}
  - wifi: rtlwifi: pci: fix possible use-after-free caused by unfinished irq_prepare_bcn_tasklet {CVE-2026-53112}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els11]
changelog:
  - wifi: ath11k: update channel list in reg notifier instead reg worker {CVE-2025-23133}
  - wifi: cfg80211: call reg_notifier for self managed wiphy from driver hint {CVE-2025-23133}
  - KVM: SVM: Forcibly leave SMM mode on SHUTDOWN interception {CVE-2025-37957}
  - KVM: x86: forcibly leave nested mode on vCPU reset {CVE-2022-3344}
  - RDMA/umem: Fix truncation for block sizes >= 4G {CVE-2026-53133}
  - crypto: arm64/poly1305 - fix a read out-of-bound {CVE-2022-50231}
  - tls: handle data disappearing from under the TLS ULP {CVE-2025-38616}
  - Bluetooth: btmtk: validate WMT event SKB length before struct access {CVE-2026-46140}
  - Bluetooth: L2CAP: complete CVE-2026-23395 hardening (chan_lock + ident clear + memset ordering)
  - wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
  - net: add exit_batch_rtnl() method
  - rxrpc: Fix data-race warning and potential load/store tearing {CVE-2026-23118}
  - virt/coco/sev-guest: Double-buffer messages {CVE-2023-53769}
  - ASoC: SOF: avoid a NULL dereference with unsupported widgets {CVE-2023-54233}
  - bnxt_en: Fix memory corruption when FW resources change during ifdown {CVE-2025-39810}
  - scsi: qla2xxx: Free sp in error path to fix system crash {CVE-2025-71232}
  - sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting {CVE-2026-23371}
  - net: rfkill: prevent unlimited numbers of rfkill events from being created {CVE-2026-31670}
  - intel_th: fix device leak on output open() {CVE-2026-23091}
  - batman-adv: reject oversized global TT response buffers {CVE-2026-31659}
  - rxrpc: Fix call removal to use RCU safe deletion {CVE-2026-31642}
  - i2c: s3c24xx: check the size of the SMBUS message before using it {CVE-2026-31627}
  - Bluetooth: L2CAP: Fix ERTM re-init and zero pdu_len infinite loop {CVE-2026-31498}
  - mtd: rawnand: serialize lock/unlock against other NAND operations {CVE-2026-23434}
  - x86/efi: defer freeing of boot services memory {CVE-2026-23352}
  - KVM: Don't clobber irqfd routing type when deassigning irqfd {CVE-2026-23198}
  - nvmet-tcp: add bounds checks in nvmet_tcp_build_pdu_iovec {CVE-2026-23112}
  - usb: typec: ucsi: Handle incorrect num_connectors capability {CVE-2025-71108}
  - KVM: x86: Fix VM hard lockup after prolonged inactivity with periodic HV timer {CVE-2025-71104}
  - drm/ttm: Avoid NULL pointer deref for evicted BOs {CVE-2025-71083}
  - amba: bus: fix refcount leak {CVE-2023-54230}
  - exfat: use kvmalloc_array/kvfree instead of kmalloc_array/kfree {CVE-2023-54194}
  - octeontx2-af: Add validation for lmac type {CVE-2023-54129}
  - rcu: dump vmalloc memory info safely {CVE-2023-54113}
  - wifi: rtw88: use work to update rate to avoid RCU warning {CVE-2023-54071}
  - bpf: fix a memory leak in the LRU and LRU_PERCPU hash maps {CVE-2023-54033}
  - ASoC: soc-compress: Reposition and add pcm_mutex {CVE-2023-53866}
  - netlink: do not hard code device address lenth in fdb dumps {CVE-2023-53863}
  - md/raid5-cache: fix a deadlock in r5l_exit_log() {CVE-2023-53848}
  - tpm: tpm_tis: Add the missed acpi_put_table() to fix memory leak {CVE-2022-50824}
  - net: stmmac: fix possible memory leak in stmmac_dvr_probe() {CVE-2022-50663}
  - bpf: Fix reference state management for synchronous callbacks {CVE-2022-50650}
  - blk-mq: fix tags leak when shrink nr_hw_queues {CVE-2023-54227}
  - usbnet: Run unregister_netdev() before unbind() again {CVE-2022-49501}
  - scsi: core: Wake up the error handler when final completions race against each other {CVE-2026-23110}
  - scsi: core: Move scsi_host_busy() out of host lock for waking up EH handler
  - perf/core: Prevent VMA split of buffer mappings {CVE-2025-38563}
  - Bluetooth: L2CAP: Fix accepting multiple L2CAP_ECRED_CONN_REQ {CVE-2026-23395}
  - Bluetooth: L2CAP: Fix responding with wrong PDU type
  - netfilter: nf_tables: release flowtable after rcu grace period on error {CVE-2026-23392}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.11.els12]
changelog:
  - net/sched: serialize qdisc_rtab_list against concurrent get/put {CVE-2026-68138}
  - static_call: Replace pointless WARN_ON() in static_call_module_notify() {CVE-2024-49954}
  - static_call: Handle module init failure correctly in static_call_del_module() {CVE-2024-50002}
  - smb: client: require a full NFS mode SID before reading mode bits {CVE-2026-43350}
  - octeontx2-pf: Fix potential use after free in otx2_tc_add_flow() {CVE-2025-39978}
  - scsi: core: Fix refcount leak for tagset_refcnt {CVE-2026-23296}
  - wifi: cfg80211: cancel rfkill_block work in wiphy_unregister() {CVE-2026-23336}
  - smb: client: fix memory leak in cifs_construct_tcon() {CVE-2025-68295}
  - sched/deadline: Fix warning in migrate_enable for boosted tasks {CVE-2024-56583}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() {CVE-2025-40261}
  - usbnet: Prevents free active kevent {CVE-2025-68312}
  - libceph: bound get_version reply decode to front len {CVE-2026-68433}
  - neigh: let neigh_xmit take skb ownership {CVE-2026-52981}
  - gve: prevent ethtool ops after shutdown {CVE-2025-38735}
  - vfs: Don't leak disconnected dentries on umount {CVE-2025-40105}
  - NFSD: NFSv4 file creation neglects setting ACL {CVE-2025-68803}
  - thermal: intel: int340x: processor: Fix warning during module unload {CVE-2024-50093}
  - quota: fix warning in dqgrab() {CVE-2023-54177}
  - mm/damon/sysfs: check contexts->nr before accessing contexts_arr[0] {CVE-2026-31458}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change {CVE-2025-71066}
  - bpf, skmsg: Fix NULL pointer dereference in sk_psock_skb_ingress_enqueue {CVE-2024-36938}
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table {CVE-2026-23054}
  - xsk: tighten UMEM headroom validation to account for tailroom and min frame {CVE-2026-43093}
  - drm/shmem-helper: Fix BUG_ON() on mmap(PROT_WRITE, MAP_PRIVATE) {CVE-2024-39497}
  - bpf: Fix OOB in pcpu_init_value {CVE-2026-53076}
  - ftrace: Clean up hash direct_functions on register failures {CVE-2022-49402}
  - binfmt_misc: restore write access before closing files opened by open_exec() {CVE-2025-68239}
  - smb: client: fix smbdirect_recv_io leak in smbd_negotiate() error path {CVE-2025-39929}
  - wifi: mt76: Fix memory leak after mt76_connac_mcu_alloc_sta_req() {CVE-2026-53102}
  - xen: Add support for XenServer 6.1 platform device {CVE-2025-38046}
  - i2c: tegra: Do not mark ACPI devices as irq safe {CVE-2024-45029}
  - bpf: Add preempt_count_{sub,add} into btf id deny list {CVE-2023-54086}
  - libceph: Fix multiplication overflow in decode_new_up_state_weight() {CVE-2026-68158}
  - mptcp: Initialise rcv_mss before calling tcp_send_active_reset() in mptcp_do_fastclose() {CVE-2025-68291}
  - net/mlx5: Fix missing lock on sync reset reload {CVE-2024-42268}
  - vxlan: require CAP_NET_ADMIN in the device netns for changelink {CVE-2026-68432}
  - netfilter: xt_IDLETIMER: reject rev0 reuse of ALARM timer labels {CVE-2026-23274}
  - drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async {CVE-2026-64219}
  - mac80211: fix crash in ieee80211_chan_bw_change for AP_VLAN stations {CVE-2026-31394}
  - bpf: Use RCU-safe iteration in dev_map_redirect_multi() SKB path {CVE-2026-53096}
  - scsi: mpi3mr: Fix possible crash when setting up bsg fails {CVE-2025-21723}
  - net: usb: qmi_wwan: initialize MAC header offset in qmimux_rx_fixup {CVE-2025-68192}
  - net: stream: purge sk_error_queue in sk_stream_kill_queues() {CVE-2022-50838}
  - clocksource: Use migrate_disable() to avoid calling get_random_u32() in atomic context {CVE-2025-21767}
  - net: netpoll: fix incorrect refcount handling causing incorrect cleanup {CVE-2025-68245}
  - drm/amd/display: Check link_res->hpo_dp_link_enc before using it {CVE-2024-47704}
  - crypto: qat - flush misc workqueue during device shutdown {CVE-2025-39721}
  - crypto: ccp: Don't attempt to copy PDH cert to userspace if PSP command failed {CVE-2026-31698}
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races {CVE-2026-23230}
  - net/smc: initialize close_work early to avoid warning {CVE-2024-56641}
  - netfilter: nft_ct: add seqadj extension for natted connections {CVE-2025-68206}
  - net/sched: sch_netem: fix out-of-bounds access in packet corruption {CVE-2026-31675}
  - ACPI: EC: clean up handlers on probe failure in acpi_ec_setup() {CVE-2026-31426}
  - bpf: Reject sleepable kprobe_multi programs at attach time {CVE-2026-43010}
  - ASoC: soc-core: flush delayed work before removing DAIs and widgets {CVE-2026-43459}
  - mm: hugetlb: avoid soft lockup when mprotect to large memory area {CVE-2025-40153}
  - mptcp: pm: ADD_ADDR rtx: fix potential data-race {CVE-2026-46137}
  - Input: uinput - take event lock when submitting FF request "event"
  - smb3: fix lock ordering potential deadlock in cifs_sync_mid_result {CVE-2024-35998}
  - drm/i915/gem: Add missing nospec on parallel submit slot {CVE-2026-68269}
  - netfilter: ebtables: fix table blob use-after-free {CVE-2023-54243}
  - net/mlx5e: xsk: Fix unlocked writing to ICOSQ {CVE-2026-64210}
  - drm/i915/gem: Fix NULL deref in I915_CONTEXT_PARAM_SSEU {CVE-2026-68243}
  - media: dvb-core: fix wrong reinitialization of ringbuffer on reopen {CVE-2026-23253}
  - drm/tegra: nvdec: Fix dma_alloc_coherent error check {CVE-2025-38543}
  - tls: Purge async_hold in tls_decrypt_async_wait() {CVE-2026-23414}
  - tun: free page on build_skb failure in tun_xdp_one() {CVE-2026-46322}
  - octeontx2-pf: handle otx2_mbox_get_rsp errors in otx2_dcbnl.c {CVE-2024-56725}
  - cpufreq: CPPC: Add u64 casts to avoid overflowing {CVE-2022-49750}
  - irqchip/gic-v3: Fix refcount leak in gic_populate_ppi_partitions {CVE-2022-49715}
  - ip6_vti: prevent moving the fallback device across netns {CVE-2026-52909}
  - spi: fix use-after-free on controller registration failure {CVE-2026-31389}
  - ipv6: Fix memleak of nhc_pcpu_rth_output in fib_check_nh_v6_gw() {CVE-2025-22005}
  - bpf: Fix stackmap overflow check in __bpf_get_stackid() {CVE-2025-68378}
  - bpf: Fix RCU stall in bpf_fd_array_map_clear() {CVE-2026-53083}
  - drm/amd/display: Use krealloc_array() in dal_vector_reserve() {CVE-2026-53329}
  - mm/damon/sysfs-scheme: cleanup access_pattern subdirs on scheme dir setup failure {CVE-2026-23142}
  - Squashfs: reject negative file sizes in squashfs_read_inode() {CVE-2025-40200}
  - i40e: Fix preempt count leak in napi poll tracepoint {CVE-2026-23313}
  - i2c: core: fix adapter deregistration race {CVE-2026-64279}
  - NFSv4: include MAY_WRITE in open permission mask for O_TRUNC {CVE-2026-64298}
  - fuse: re-lock request before returning from fuse_ref_folio() {CVE-2026-64266}
  - RDMA/siw: bound Read Response placement to the RREAD length {CVE-2026-64268}
  - sctp: don't free the ASCONF's own transport in DEL-IP processing {CVE-2026-64564}
  - Input: elan_i2c - prevent division by zero and arithmetic underflow {CVE-2026-64275}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els27]
changelog:
  - ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() {CVE-2025-38249}
  - drm/i915/gt: Fix timeline left held on VMA alloc error {CVE-2025-38389}
  - md/raid1: Fix stack memory use after return in raid1_reshape {CVE-2025-38445}
  - atm: clip: Fix infinite recursive call of clip_push(). {CVE-2025-38459}
  - bpf: Avoid __bpf_prog_ret0_warn when jit fails {CVE-2025-38280}
  - ipv6: Fix infinite recursion in fib6_dump_done(). {CVE-2024-35886}
  - netfilter: nf_tables: do not compare internal table flags on updates {CVE-2024-27065}
  - init/main.c: Fix potential static_command_line memory overflow {CVE-2024-26988}
  - wireguard: netlink: check for dangling peer via is_dead instead of empty list {CVE-2024-26951}
  - platform/x86: dell-wmi-sysman: Avoid buffer overflow in current_password_store() {CVE-2025-38077}
  - exfat: fix double free in delayed_free {CVE-2025-38206}
  - net: openvswitch: Fix the dead loop of MPLS parse {CVE-2025-38146}
  - wifi: iwlwifi: dvm: Fix memcpy: detected field-spanning write {CVE-2023-54286}
  - vsock: Do not allow binding to VMADDR_PORT_ANY {CVE-2025-38618}
  - fbcon: Make sure modelist not set on unregistered console {CVE-2025-38198}
  - crypto: lzo - Fix compression buffer overrun {CVE-2025-38068}
  - software node: Correct a OOB check in {CVE-2025-38342}
  - nbd: fix uaf in nbd_genl_connect() error path {CVE-2025-38443}
  - USB: usbtmc: Fix direction for 0-length ioctl control messages {CVE-2023-53761}
  - cifs: fix potential use-after-free bugs in TCP_Server_Info::hostname {CVE-2023-53751}
  - cifs: Fix warning and UAF when destroy the MR list {CVE-2023-53427}
  - PCI/ASPM: Fix link state exit during switch upstream function removal {CVE-2024-58093}
  - PCI/ASPM: Disable ASPM on MFD function removal to avoid use-after-free {CVE-2023-53446}
  - sctp: fix a potential overflow in sctp_ifwdtsn_skip {CVE-2023-53372}
  - md/raid10: fix wrong setting of max_corr_read_errors {CVE-2023-53313}
  - md/raid10: fix overflow of md/safe_mode_delay
  - md/raid10: check slab-out-of-bounds in md_bitmap_get_counter {CVE-2023-53357}
  - lwt: Fix return values of BPF xmit ops {CVE-2023-53338}
  - net: fec: Better handle pm_runtime_get() failing in .remove() {CVE-2023-53308}
  - rbd: avoid use-after-free in do_rbd_add() when rbd_dev_create() fails {CVE-2023-53307}
  - ice: set tx_tstamps when creating new Tx rings via ethtool {CVE-2022-50710}
  - RDMA/mlx5: Return the firmware result upon destroying QP/RQ {CVE-2023-53286}
  - RDMA/mlx5: Handle DCT QP logic separately from low level QP interface
  - net/mlx5e: Use correct encap attribute during invalidation {CVE-2023-54074}
  - net/mlx5: Nullify qp->dbg pointer post destruction
  - scsi: lpfc: Fix use-after-free KFENCE violation during sysfs firmware write {CVE-2023-53282}
  - net: ena: fix shift-out-of-bounds in exponential backoff {CVE-2023-53272}
  - ubi: ensure that VID header offset + VID header size <= alloc, size {CVE-2023-53265}
  - sched/fair: Don't balance task to its current running CPU {CVE-2023-53215}
  - netfilter: allow exp not to be removed in nf_ct_find_expectation {CVE-2023-52927}
  - wifi: ath9k: Fix use-after-free in ath9k_hif_usb_disconnect() {CVE-2022-50881}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els28]
changelog:
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit {CVE-2025-39766}
  - NFSD: Avoid calling OPDESC() with ops->opnum == OP_ILLEGAL {CVE-2023-53680}
  - scsi: target: iscsi: Fix buffer overflow in lio_target_nacl_info_show() {CVE-2023-53676}
  - KVM: x86: use array_index_nospec with indices that come from guest {CVE-2025-39823}
  - ftrace: Also allocate and copy hash for reading of filter files {CVE-2025-39689}
  - ext4: improve error handling from ext4_dirhash() {CVE-2023-53473}
  - rcu: Protect ->defer_qs_iw_pending from data race {CVE-2025-39749}
  - ring-buffer: Fix deadloop issue on reading trace_pipe {CVE-2023-53668}
  - fs/proc: fix uaf in proc_readdir_de() {CVE-2025-40271}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer {CVE-2025-40269}
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free {CVE-2025-40141}
  - pptp: ensure minimal skb length in pptp_xmit() {CVE-2025-38574}
  - lib: cpu_rmap: Avoid use after free on rmap->obj array entries {CVE-2023-53484}
  - ipv6: reject malicious packets in ipv6_gso_segment() {CVE-2025-38572}
  - fbdev: Fix vmalloc out-of-bounds write in fast_imageblit {CVE-2025-38685}
  - fbdev: fix potential buffer overflow in do_register_framebuffer() {CVE-2025-38702}
  - i40e: fix IRQ freeing in i40e_vsi_request_irq_msix error path {CVE-2025-39911}
  - libceph: fix invalid accesses to ceph_connection_v1_info {CVE-2025-39880}
  - bus: mhi: host: Detect events pointing to unexpected TREs {CVE-2025-39790}
  - nvmet: fix out-of-bounds access in nvmet_enable_port {CVE-2025-37825}
  - net: core: remove unnecessary frame_sz check in bpf_xdp_adjust_tail() {CVE-2023-54155}
  - wifi: mwifiex: Initialize the chan_stats array to zero {CVE-2025-39891}
  - i40e: Fix potential invalid access when MAC list is empty {CVE-2025-39853}
  - media: uvcvideo: Fix 1-byte out-of-bounds read in uvc_parse_format() {CVE-2025-38680}
  - fs/buffer: fix use-after-free when call bh_read() helper {CVE-2025-39691}
  - net/mlx5: Devcom, fix error flow in mlx5_devcom_register_device {CVE-2023-54015}
  - x86/sev: Make enc_dec_hypercall() accept a size instead of npages {CVE-2023-53996}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring {CVE-2025-38129}
  - page_pool: fix inconsistency for page_pool_ring_[un]lock()
  - net: page_pool: use in_softirq() instead {CVE-2025-38129}
  - vsock: Ignore signal/timeout on connect() if already established {CVE-2025-40248}
  - vsock: avoid to close connected socket after the timeout {CVE-2025-40248}
  - sctp: avoid NULL dereference when chunk data buffer is missing {CVE-2025-40240}
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length {CVE-2025-39933}
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver {CVE-2025-39905}
  - i40e: validate ring_len parameter against hardware-specific values
  - i40e: add validation for ring_len param {CVE-2025-39973}
  - i40e: increase max descriptors for XL710
  - i40e: remove read access to debugfs files {CVE-2025-39901}
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory {CVE-2025-39883}
  - wifi: brcmfmac: fix use-after-free when rescheduling brcmf_btcoex_info work {CVE-2025-39863}
  - i2c: tegra: check msg length in SMBUS block read {CVE-2025-38425}
  - regulator: gpio: Fix the out-of-bounds access to drvdata::gpiods {CVE-2025-38395}
  - virtio-net: ensure the received length does not exceed allocated size {CVE-2025-38375}
  - VMCI: fix race between vmci_host_setup_notify and vmci_ctx_unset_notify {CVE-2025-38102}
  - vsock/vmci: Clear the vmci transport packet properly when initializing it {CVE-2025-38403}
  - can: bcm: add locking for bcm_op runtime updates {CVE-2025-38004}
  - scsi: lpfc: Prevent lpfc_debugfs_lockstat_write() buffer overflow {CVE-2023-54102}
  - tcp: fix a signed-integer-overflow bug in tcp_add_backlog() {CVE-2022-50865}
  - tcp: minor optimization in tcp_add_backlog() {CVE-2022-50865}
  - block, bfq: fix uaf for bfqq in bic_set_bfqq() {CVE-2023-52983}
  - block, bfq: replace 0/1 with false/true in bic apis
  - block, bfq: fix uaf for bfqq in bfq_exit_icq_bfqq {CVE-2022-50329}
  - block, bfq: fix possible uaf for 'bfqq->bic' {CVE-2022-50488}
  - ALSA: usb-audio: Validate UAC3 power domain descriptors, too {CVE-2025-38729}
  - Squashfs: check return result of sb_min_blocksize {CVE-2025-38415}
  - ftrace: Fix UAF when lookup kallsym after ftrace disabled {CVE-2025-38346}
  - arm64/ptrace: Fix stack-out-of-bounds read in regs_get_kernel_stack_nth() {CVE-2025-38320}
  - ipc: fix to protect IPCS lookups using RCU {CVE-2025-38212}
  - net/mdiobus: Fix potential out-of-bounds read/write access {CVE-2025-38111}
  - net: mdio: C22 is now optional, EOPNOTSUPP if not provided
  - net: atm: fix /proc/net/atm/lec handling {CVE-2025-38180}
  - net: atm: add lec_mutex {CVE-2025-38323}
  - Bluetooth: hci_sync: always check if connection is alive before deleting
  - Bluetooth: hci_sync: Fix UAF in hci_disconnect_all_sync {CVE-2023-53762}
  - Bluetooth: hci_sync: Fix UAF on hci_abort_conn_sync
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete {CVE-2025-38118}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in mgmt_remove_adv_monitor_sync {CVE-2024-58013}
  - net_sched: remove qdisc_tree_flush_backlog()
  - net_sched: ets: fix a race in ets_qdisc_change() {CVE-2025-38107}
  - net_sched: tbf: fix a race in tbf_change()
  - net_sched: prio: fix a race in prio_tune() {CVE-2025-38083}
  - net_sched: red: fix a race in __red_change() {CVE-2025-38108}
  - HID: usbhid: Eliminate recurrent out-of-bounds bug in usbhid_parse() {CVE-2025-38103}
  - smb: client: Fix use-after-free in cifs_fill_dirent {CVE-2025-38051}
  - wifi: ath9k_htc: Abort software beacon handling if disabled {CVE-2025-38157}
  - wifi: mac80211: Set n_channels after allocating struct cfg80211_scan_request {CVE-2025-38013}
  - libceph: fix potential use-after-free in have_mon_and_osd_map() {CVE-2025-68285}
  - VMCI: check context->notify_page after call to get_user_pages_fast() to avoid GPF {CVE-2023-53259}
  - mptcp: fix race condition in mptcp_schedule_work() {CVE-2025-40258}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping {CVE-2025-40154}
  - wifi: ath10k: Delay the unmapping of the buffer {CVE-2022-50700}
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind {CVE-2025-68305}
  - ALSA: pcm: Fix potential data race at PCM memory allocation helpers {CVE-2023-54072}
  - drm/amd/display: fix FCLK pstate change underflow {CVE-2023-53780}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE {CVE-2025-40277}
  - atm: Release atm_dev_mutex after removing procfs in atm_dev_deregister(). {CVE-2025-38245}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els29]
changelog:
  - fix: fbdev: fix potential buffer overflow in do_register_framebuffer()
  - qed: Don't collect too many protection override GRC elements {CVE-2025-39949}
  - drm/amd/display: Avoid a NULL pointer dereference {CVE-2025-39693}
  - pNFS: Fix uninited ptr deref in block/scsi layout {CVE-2025-38691}
  - netfilter: nf_reject: don't leak dst refcount for loopback packets {CVE-2025-38732}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() {CVE-2025-71085}
  - fs: dlm: fix use after free in midcomms commit {CVE-2023-53629}
  - svcrdma: use rc_pageoff for memcpy byte offset {CVE-2025-68811}
  - bpf: Disable preemption in bpf_perf_event_output {CVE-2023-54303}
  - scsi: target: iscsit: Free cmds before session free {CVE-2023-54184}
  - fbdev: bitblit: bound-check glyph index in bit_putcs* {CVE-2025-40322}
  - scsi: libsas: Fix use-after-free bug in smp_execute_task_sg() {CVE-2022-50422}
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem {CVE-2025-38022}
  - memcg: protect concurrent access to mem_cgroup_idr {CVE-2024-43892}
  - ACPI: EC: Fix oops when removing custom query handlers {CVE-2023-54244}
  - KVM: SVM: Get source vCPUs from source VM for SEV-ES intrahost migration {CVE-2023-54296}
  - net: nsh: Use correct mac_offset to unwind gso skb in nsh_gso_segment() {CVE-2023-54114}
  - net: tls: avoid hanging tasks on the tx_lock {CVE-2023-54306}
  - usb: typec: bus: verify partner exists in typec_altmode_attention {CVE-2023-54299}
  - scsi: mpi3mr: Fix missing mrioc->evtack_cmds initialization {CVE-2023-54234}
  - rxrpc: Fix timeout of a call that hasn't yet been granted a channel {CVE-2023-54195}
  - block, bfq: Fix division by zero error on zero wsum {CVE-2023-54242}
  - wifi: cfg80211: reject auth/assoc to AP with our address {CVE-2023-53540}
  - wifi: iwlwifi: mvm: don't trust firmware n_channels {CVE-2023-53589}
  - wifi: mac80211: check for station first in client probe {CVE-2023-53588}
  - bonding: do not assume skb mac_header is set {CVE-2023-53601}
  - drm/i915: Make intel_get_crtc_new_encoder() less oopsy {CVE-2023-53571}
  - wifi: rtw88: delete timer and free skb queue when unloading {CVE-2023-53574}
  - net: bcmgenet: Add a check for oversized packets {CVE-2023-53535}
  - media: uvcvideo: Fix memory leak in uvc_gpio_parse {CVE-2022-50882}
  - md/raid10: fix memleak of md thread {CVE-2023-54294}
  - usb: typec: altmodes/displayport: fix pin_assignment_show {CVE-2023-54186}
  - scsi: qedf: Fix NULL dereference in error handling {CVE-2023-54289}
  - HID: multitouch: Add NULL check in mt_input_configured {CVE-2024-58020}
  - driver core: fix potential null-ptr-deref in device_add() {CVE-2023-54321}
  - net: usb: smsc75xx: Move packet length check to prevent kernel panic in skb_pull {CVE-2023-53125}
  - rcuscale: Move rcu_scale_writer() schedule_timeout_uninterruptible() to _idle() {CVE-2023-54246}
  - bpf: Address KCSAN report on bpf_lru_list {CVE-2023-54283}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing {CVE-2025-39760}
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec {CVE-2026-22998}
  - drm/i915: fix race condition UAF in i915_perf_add_config_ioctl {CVE-2023-54202}
  - mmc: via-sdmmc: fix return value check of mmc_add_host() {CVE-2022-50846}
  - bpf: Disable preemption in bpf_event_output {CVE-2023-54173}
  - net/mlx5e: Move representor neigh cleanup to profile cleanup_tx {CVE-2023-54148}
  - net/mlx5: Handle pairing of E-switch via uplink un/load APIs {CVE-2023-53347}
  - net/mlx5e: Fix cleanup null-ptr deref on encap lock {CVE-2023-53105}
  - smb3: fix for slab out of bounds on mount to ksmbd {CVE-2025-38728}
  - perf/core: Exit early on perf_mmap() fail {CVE-2025-38565}
  - HID: core: do not bypass hid_hw_raw_request {CVE-2025-38494}
  - HID: core: ensure __hid_request reserves the report ID as the first byte
  - HID: core: ensure the allocated report buffer can contain the reserved report ID {CVE-2025-38495}
  - HID: intel-ish-hid: Fix kernel panic during warm reset {CVE-2023-53392}
  - xfs: do not propagate ENODATA disk errors into xattr code {CVE-2025-39835}
  - phy: tegra: xusb: Fix unbalanced regulator disable in UTMI PHY mode {CVE-2025-38535}
  - wifi: iwlwifi: pcie: Fix integer overflow in iwl_write_to_user_buf {CVE-2023-53524}
  - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX {CVE-2025-38201}
  - xfrm: fix slab-use-after-free in decode_session6 {CVE-2023-53500}
  - drm/amdgpu/gfx: disable gfx9 cp_ecc_error_irq only when enabling legacy gfx ras {CVE-2023-53471}
  - drm/edid: fix info leak when failing to get panel id {CVE-2023-53085}
  - xhci: Remove device endpoints from bandwidth list when freeing the device {CVE-2022-50470}
  - vdpa: Add features attr to vdpa_nl_policy for nlattr length check {CVE-2023-53652}
  - virtio-mmio: don't break lifecycle of vm_dev {CVE-2023-53515}
  - virtio_net: fix xdp_rxq_info bug after suspend/resume {CVE-2022-49687}
  - drivers: net: prevent tun_build_skb() to exceed the packet size limit
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds {CVE-2025-40304}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy {CVE-2025-40251}
  - tracing: Limit access to parser->buffer when trace_get_user failed {CVE-2025-39683}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid {CVE-2025-68349}
  - HID: multitouch: Correct devm device reference for hidinput input_dev name {CVE-2023-53454}
  - HID: asus: fix UAF via HID_CLAIMED_INPUT validation {CVE-2025-39824}
  - udf: Do not bother merging very long extents {CVE-2023-53506}
  - cnic: Fix use-after-free bugs in cnic_delete_task {CVE-2025-39945}
  - fs: writeback: fix use-after-free in __mark_inode_dirty() {CVE-2025-39866}
  - tcp_bpf: Call sk_msg_free() when tcp_bpf_send_verdict() fails to allocate psock->cork. {CVE-2025-39913}
  - ring-buffer: Sync IRQ works before buffer destruction {CVE-2023-53587}
  - tunnels: fix kasan splat when generating ipv4 pmtu error {CVE-2023-53600}
  - dm integrity: call kmem_cache_destroy() in dm_integrity_init() error path {CVE-2023-53604}
  - tracing/histograms: Add histograms to hist_vars if they have referenced variables {CVE-2023-53560}
  - netfilter: conntrack: Avoid nf_ct_helper_hash uses after free {CVE-2023-53619}
  - gfs2: Fix possible data races in gfs2_show_options() {CVE-2023-53622}
  - iavf: Fix use-after-free in free_netdev {CVE-2023-53556}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els30]
changelog:
  - crypto: algif_aead - Fix minimum RX size check for decryption {CVE-2026-31431}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-31431}
  - crypto: authencesn - Fix src offset when decrypting in-place {CVE-2026-31431}
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption {CVE-2026-31431}
  - crypto: authenc - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: algif_aead - snapshot IV for async AEAD requests {CVE-2026-31431}
  - crypto: algif_aead - Revert to operating out-of-place {CVE-2026-31431}
  - crypto: algif_aead - use memcpy_sglist() instead of null skcipher {CVE-2026-31431}
  - crypto: scatterwalk - Backport memcpy_sglist() {CVE-2026-31431}
  - wifi: brcmfmac: Fix potential shift-out-of-bounds in brcmf_fw_alloc_request() {CVE-2022-50551}
  - bonding: limit BOND_MODE_8023AD to Ethernet devices {CVE-2026-23099}
  - libceph: make decode_pool() more resilient against corrupted osdmaps {CVE-2025-71116}
  - scsi: qla2xxx: Fix bsg_done() causing double free {CVE-2025-71238}
  - ftrace: Fix use-after-free for dynamic ftrace_ops {CVE-2022-49892}
  - intel_th: msu: Fix vmalloced buffers {CVE-2022-50142}
  - vt: Clear selection before changing the font {CVE-2022-49948}
  - ACPICA: Fix error code path in acpi_ds_call_control_method() {CVE-2022-50411}
  - usbnet: Run unregister_netdev() before unbind_all() {CVE-2022-50220}
  - ipvs: fix WARNING in ip_vs_app_net_cleanup() {CVE-2022-49917}
  - bpf: Propagate error from htab_lock_bucket() to userspace {CVE-2022-50490}
  - binfmt_misc: fix shift-out-of-bounds in check_special_flags {CVE-2022-50497}
  - module: fix [e_shstrndx].sh_size=0 OOB access {CVE-2022-49444}
  - ceph: avoid putting the realm twice when decoding snaps fails {CVE-2022-49770}
  - tracing: Fix potential double free in create_var_ref() {CVE-2022-49410}
  - powercap: intel_rapl: fix UBSAN shift-out-of-bounds issue {CVE-2022-50366}
  - Bluetooth: hci_sysfs: Fix attempting to call device_add multiple times {CVE-2022-50419}
  - xsk: Fix xsk_diag use-after-free error during socket cleanup {CVE-2023-53426}
  - svcrdma: bound check rq_pages index in inline path {CVE-2025-71068}
  - net: hns3: add VLAN id validation before using {CVE-2025-71112}
  - net: mdio: fix undefined behavior in bit shift for __mdiobus_register {CVE-2022-49907}
  - capabilities: fix undefined behavior in bit shift for CAP_TO_MASK {CVE-2022-49870}
  - ata: ahci: Match EM_MAX_SLOTS with SATA_PMP_MAX_PORTS {CVE-2022-50315}
  - i2c: piix4: Fix adapter not be removed in piix4_remove() {CVE-2022-49900}
  - team: fix check for port enabled in team_queue_override_port_prio_changed() {CVE-2025-71091}
  - staging: vme_user: Fix possible UAF in tsi148_dma_list_add {CVE-2022-50384}
  - ALSA: ctxfi: Fix potential OOB access in audio mixer handling {CVE-2026-23076}
  - ftrace: Add cond_resched() to ftrace_graph_set_hash() {CVE-2025-37940}
  - net: stmmac: Fix accessing freed irq affinity_hint {CVE-2025-23155}
  - ext4: set goal start correctly in ext4_mb_normalize_request {CVE-2023-54021}
  - netfilter: ipset: fix region locking in hash types {CVE-2025-37997}
  - openvswitch: Fix unsafe attribute parsing in output_userspace() {CVE-2025-37998}
  - wifi: brcm80211: fmac: Add error handling for brcmf_usb_dl_writeimage() {CVE-2025-37990}
  - nfs: handle failure of nfs_get_lock_context in unlock path {CVE-2025-38023}
  - drm/amd/pm: Prevent division by zero {CVE-2025-37767}
  - netfilter: ctnetlink: remove refcounting in expectation dumpers {CVE-2025-39764}
  - tracing: Fix null pointer dereference in tracing_err_log_open() {CVE-2023-53167}
  - ACPICA: Refuse to evaluate a method if arguments are missing {CVE-2025-38386}
  - scsi: qla2xxx: Pointer may be dereferenced {CVE-2023-53150}
  - net: pktgen: fix access outside of user given buffer in pktgen_thread_write() {CVE-2025-38061}
  - dm cache: prevent BUG_ON by blocking retries on failed device resumes {CVE-2025-38066}
  - libnvdimm/labels: Fix divide error in nd_label_data_init() {CVE-2025-38072}
  - wifi: iwlwifi: pcie: fix NULL pointer dereference in iwl_pcie_irq_rx_msix_handler() {CVE-2023-53251}
  - tracing: Free error logs of tracing instances {CVE-2023-53375}
  - perf: Revert to requiring CAP_SYS_ADMIN for uprobes {CVE-2025-38466}
  - gve: add missing NULL check for gve_alloc_pending_packet() in TX DQO {CVE-2025-38122}
  - dma-buf: insert memory barrier before updating num_fences {CVE-2025-38095}
  - x86/sgx: Prevent attempts to reclaim poisoned pages {CVE-2025-38334}
  - ext4: inline: fix len overflow in ext4_prepare_inline_data {CVE-2025-38222}
  - fbdev: Fix fb_set_var to prevent null-ptr-deref in fb_videomode_to_var {CVE-2025-38214}
  - sctp: initialize more fields in sctp_v6_from_sk() {CVE-2025-39812}
  - atm: Revert atm_account_tx() if copy_from_iter_full() fails. {CVE-2025-38190}
  - usb: net: sierra: check for no status endpoint {CVE-2025-38474}
  - vxlan: Annotate FDB data races {CVE-2025-38037}
  - tipc: fix null-ptr-deref when acquiring remote ip of ethernet bearer {CVE-2025-38184}
  - calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). {CVE-2025-38181}
  - net_sched: sch_sfq: fix a potential crash on gso_skb handling {CVE-2025-38115}
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert {CVE-2025-38387}
  - jbd2: fix data-race and null-ptr-deref in jbd2_journal_dirty_metadata() {CVE-2025-38337}
  - mpls: Use rcu_dereference_rtnl() in mpls_route_input_rcu(). {CVE-2025-38324}
  - fbdev: core: fbcvt: avoid division by 0 in fb_cvt_hperiod() {CVE-2025-38312}
  - usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
  - nfsd: nfsd4_spo_must_allow() must check this is a v4 compound request {CVE-2025-38430}
  - wifi: ath9k: hif_usb: Fix use-after-free in ath9k_hif_usb_reg_in_cb() {CVE-2022-50829}
  - wifi: mt76: disable napi on driver removal {CVE-2025-38009}
  - ftrace: Fix potential warning in trace_printk_seq during ftrace_dump {CVE-2025-39813}
  - net/sched: Abort __tc_modify_qdisc if parent class does not exist {CVE-2025-38457}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() {CVE-2026-23216}
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb {CVE-2025-71082}
  - e1000: fix OOB in e1000_tbi_should_accept() {CVE-2025-71093}
  - RDMA/irdma: avoid invalid read in irdma_net_event {CVE-2025-71133}
  - scsi: qla4xxx: Prevent a potential error pointer dereference {CVE-2025-39676}
  - ppp: fix race conditions in ppp_fill_forward_path {CVE-2025-39673}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() {CVE-2026-22990}
  - thunderbolt: Do not double dequeue a configuration request {CVE-2025-38174}
  - bnxt_en: Set DMA unmap len correctly for XDP_REDIRECT {CVE-2025-38439}
  - ACPICA: fix acpi operand cache leak in dswstate.c {CVE-2025-38345}
  - atm: clip: Fix potential null-ptr-deref in to_atmarpd(). {CVE-2025-38460}
  - dm: fix unconditional IO throttle caused by REQ_PREFLUSH {CVE-2025-38063}
  - shmem: use ramfs_kill_sb() for kill_sb method of ramfs-based tmpfs {CVE-2023-53391}
  - nfsd: Initialize ssc before laundromat_work to prevent NULL dereference {CVE-2025-38231}
  - udf: Do not update file length for failed writes to inline files {CVE-2023-53295}
  - bpf: Fix WARN() in get_bpf_raw_tp_regs {CVE-2025-38285}
  - net/sched: Return NULL when htb_lookup_leaf encounters an empty rbtree {CVE-2025-38468}
  - nvmet-tcp: don't restore null sk_state_change {CVE-2025-38035}
  - wifi: iwlwifi: mvm: fix double free on tx path. {CVE-2022-50248}
  - ACPICA: fix acpi parse and parseext cache leaks {CVE-2025-38344}
  - bonding: fix use-after-free due to enslave fail after slave array update {CVE-2026-23171}
  - macvlan: fix error recovery in macvlan_common_newlink() {CVE-2026-23209}
  - cxl/acpi: Fix a use-after-free in cxl_parse_cfmws() {CVE-2023-53479}
  - fbcon: Fix OOB access in font allocation
  - fbcon: fix integer overflow in fbcon_do_set_font {CVE-2025-39967}
  - ALSA: aloop: Fix racy access at PCM trigger {CVE-2026-23191}
  - rename(): fix the locking of subdirectories
  - scsi: qedi: Fix use after free bug in qedi_remove() {CVE-2023-54100}
  - ixgbe: Fix panic during XDP_TX with > 64 CPUs {CVE-2023-54090}
  - bpf: Do not let BPF test infra emit invalid GSO types to stack {CVE-2025-68725}
  - net: usb: rtl8150: fix memory leak on usb_submit_urb() failure {CVE-2025-71154}
  - scsi: qla2xxx: Check valid rport returned by fc_bsg_to_rport() {CVE-2023-54014}
  - selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context() {CVE-2022-50699}
  - HID: hid-ntrig: fix unable to handle page fault in ntrig_report_version() {CVE-2025-39808}
  - PCI: Fix dropping valid root bus resources with .end = zero {CVE-2023-53814}
  - KVM: nSVM: Load L1's TSC multiplier based on L1 state, not L2 state {CVE-2023-53208}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v10_0_hw_fini {CVE-2023-53193}
  - block: avoid possible overflow for chunk_sectors check in blk_stack_limits() {CVE-2025-39795}
  - libceph: return the handler error from mon_handle_auth_done() {CVE-2026-22992}
  - Bluetooth: Fix hci_suspend_sync crash {CVE-2023-53520}
  - jbd2: prevent softlockup in jbd2_log_do_checkpoint() {CVE-2025-39782}
  - net: sock: fix hardened usercopy panic in sock_recv_errqueue {CVE-2026-22977}
  - wifi: ath11k: clear initialized flag for deinit-ed srng lists {CVE-2025-38601}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec {CVE-2026-23060}
  - libceph: make free_choose_arg_map() resilient to partial allocation {CVE-2026-22991}
  - soundwire: fix enumeration completion {CVE-2023-54096}
  - ext4: fix inode leak in ext4_xattr_inode_create() on an error path {CVE-2022-50845}
  - ring-buffer: Handle race between rb_move_tail and rb_check_pages {CVE-2023-53709}
  - netlink: fix potential deadlock in netlink_set_err() {CVE-2023-53731}
  - xhci: dbc: Fix memory leak in xhci_alloc_dbc() {CVE-2022-50809}
  - ext4: fix delayed allocation bug in ext4_clu_mapped for bigalloc + inline {CVE-2022-50286}
  - ubi: ubi_wl_put_peb: Fix infinite loop when wear-leveling work failed {CVE-2023-53481}
  - driver core: location: Free struct acpi_pld_info *pld before return false {CVE-2023-53211}
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() {CVE-2025-39845}
  - dma-buf/dma-resv: Stop leaking on krealloc() failure {CVE-2023-53181}
  - rxrpc: Fix oops due to non-existence of prealloc backlog struct {CVE-2025-38514}
  - xfrm: Zero padding when dumping algos and encap {CVE-2023-53684}
  - ALSA: ac97: Fix possible NULL dereference in snd_ac97_mixer {CVE-2023-53648}
  - vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF {CVE-2023-53747}
  - ice: fix wrong fallback logic for FDIR {CVE-2023-54040}
  - cifs: Fix xid leak in cifs_create() {CVE-2022-50351}
  - drm/amd/display: populate subvp cmd info only for the top pipe {CVE-2023-53806}
  - netfilter: ctnetlink: fix refcount leak on table dump {CVE-2025-38721}
  - sfc: fix crash when reading stats while NIC is resetting {CVE-2023-54156}
  - Bluetooth: Fix race condition in hidp_session_thread {CVE-2023-54120}
  - bpf: Reject %p% format string in bprintf-like helpers {CVE-2025-38528}
  - RDMA/bnxt_re: Prevent handling any completions after qp destroy {CVE-2023-54048}
  - RDMA/siw: Fix immediate work request flush to completion queue {CVE-2022-50736}
  - net/packet: fix a race in packet_set_ring() and packet_notifier() {CVE-2025-38617}
  - ext4: do not BUG when INLINE_DATA_FL lacks system.data xattr {CVE-2025-38701}
  - IB/hfi1: Fix possible panic during hotplug remove {CVE-2023-53488}
  - cgroup: split cgroup_destroy_wq into 3 workqueues {CVE-2025-39953}
  - NFS: Fix the setting of capabilities when automounting a new filesystem {CVE-2025-39798}
  - fs: Prevent file descriptor table allocations exceeding INT_MAX {CVE-2025-39756}
  - ext4: remove a BUG_ON in ext4_mb_release_group_pa() {CVE-2023-53450}
  - media: rainshadow-cec: fix TOCTOU race condition in rain_interrupt() {CVE-2025-39713}
  - ALSA: usb-audio: Fix use-after-free in snd_usb_mixer_free() {CVE-2026-23089}
  - wifi: mac80211: reject TDLS operations when station is not associated {CVE-2025-38644}
  - ubi: Fix unreferenced object reported by kmemleak in ubi_resize_volume() {CVE-2023-53271}
  - RDMA/bnxt_re: wraparound mbox producer index {CVE-2023-53201}
  - x86/iopl: Cure TIF_IO_BITMAP inconsistencies {CVE-2025-38100}
  - ASoC: core: Check for rtd == NULL in snd_soc_remove_pcm_runtime() {CVE-2025-38706}
  - scsi: libiscsi: Initialize iscsi_conn->dd_data only if memory is allocated {CVE-2025-38700}
  - ALSA: hda: Fix Oops by 9.1 surround channel names {CVE-2023-53400}
  - mm: move page table sync declarations to linux/pgtable.h {CVE-2025-39844}
  - rcu: Protect rcu_print_task_exp_stall() ->exp_tasks access {CVE-2023-53419}
  - wifi: ath9k: hif_usb: clean up skbs if ath9k_hif_usb_rx_stream() fails {CVE-2023-53199}
  - HID: quirks: Add quirk for 2 Chicony Electronics HP 5MP Cameras {CVE-2025-38540}
  - scsi: ses: Don't attach if enclosure has no components {CVE-2023-53431}
  - ipv6/addrconf: fix a potential refcount underflow for idev {CVE-2023-53189}
  - wifi: ath11k: Fix SKB corruption in REO destination ring {CVE-2023-53315}
  - bpf: fix ktls panic with sockmap {CVE-2025-38166}
  - net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
  - net: openvswitch: fix race on port output {CVE-2023-53188}
  - net_sched: Flush gso_skb list too during ->change() {CVE-2025-37992}
  - netfilter: x_tables: fix percpu counter block leak on error path when creating new netns {CVE-2023-53200}
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction {CVE-2025-38161}
  - af_unix: Fix data-race around unix_tot_inflight. {CVE-2023-54006}
  - watchdog: Fix kmemleak in watchdog_cdev_register {CVE-2023-53234}
  - usb: idmouse: fix an uninit-value in idmouse_open {CVE-2022-50733}
  - net: dcb: choose correct policy to parse DCB_ATTR_BCN {CVE-2023-53369}
  - mmc: rtsx_usb_sdmmc: fix return value check of mmc_add_host() {CVE-2022-50347}
  - Bluetooth: l2cap: Check encryption key size on incoming connection {CVE-2025-39889}
  - x86/apic: Don't disable x2APIC if locked {CVE-2022-50720}
  - serial: 8250: Reinit port->pm on port specific driver unbind {CVE-2023-53176}
  - devlink: hold region lock when flushing snapshots {CVE-2022-50712}
  - net: qrtr: Fix a refcount bug in qrtr_recvmsg() {CVE-2023-53445}
  - be2net: Fix NULL pointer dereference in be_cmd_get_mac_from_list {CVE-2026-23084}
  - PM: EM: fix memory leak with using debugfs_lookup() {CVE-2023-53411}
  - vdpa: Add queue index attr to vdpa_nl_policy for nlattr length check {CVE-2023-54031}
  - atm: clip: prevent NULL deref in clip_push() {CVE-2025-38251}
  - ceph: fix potential use-after-free bug when trimming caps {CVE-2023-53867}
  - ACPI: video: check for error while searching for backlight device parent {CVE-2023-52693}
  - cifs: fix DFS traversal oops without CONFIG_CIFS_DFS_UPCALL {CVE-2023-53246}
  - x86/xen: Fix memory leak in xen_init_lock_cpu() {CVE-2022-50761}
  - net: stmmac: make sure that ptp_rate is not 0 before configuring timestamping {CVE-2025-38126}
  - platform/x86: dell_rbu: Fix list usage {CVE-2025-38197}
  - x86/kexec: Fix double-free of elf header buffer {CVE-2023-54146}
  - ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
  - KVM: Destroy target device if coalesced MMIO unregistration fails {CVE-2023-54024}
  - drm/amd/pp: Fix potential NULL pointer dereference in atomctrl_initialize_mc_reg_table {CVE-2025-38319}
  - rcu: Fix __this_cpu_read() lockdep warning in rcu_force_quiescent_state() {CVE-2022-50771}
  - drm/radeon: Fix integer overflow in radeon_cs_parser_init {CVE-2023-53309}
  - net: atlantic: fix fragment overflow handling in RX path {CVE-2025-68301}
  - bpf: Fix oob access in cgroup local storage {CVE-2025-38502}
  - bpf: Add cookie object to bpf maps {CVE-2025-38502}
  - misc: vmw_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-53279}
  - platform/x86: dell-wmi-sysman: Fix WMI data block retrieval in sysfs callbacks {CVE-2025-38412}
  - virtio_ring: Fix data race by tagging event_triggered as racy for KCSAN {CVE-2025-38048}
  - tracing: Fix race issue between cpu buffer write and swap {CVE-2023-53368}
  - USB: wdm: close race between wdm_open and wdm_wwan_port_stop {CVE-2025-37985}
  - can: bcm: bcm_tx_setup(): fix KMSAN uninit-value in vfs_write {CVE-2023-53344}
  - wifi: ath11k: fix node corruption in ar->arvifs list {CVE-2025-38293}
  - x86/mm: Check return value from memblock_phys_alloc_range() {CVE-2025-38071}
  - net: Fix TOCTOU issue in sk_is_readable() {CVE-2025-38112}
  - scsi: mpi3mr: Fix an issue found by KASAN {CVE-2023-54011}
  - net/sched: cls_u32: use skb_header_pointer_careful() {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper
  - scsi: qla2xxx: Array index may go out of bound {CVE-2023-54179}
  - net/mlx5e: fix memory leak in mlx5e_ptp_open {CVE-2023-54169}
  - igc: Fix Kernel Panic during ndo_tx_timeout callback {CVE-2023-54166}
  - Bluetooth: L2CAP: Fix potential user-after-free {CVE-2023-54214}
  - RDMA/restrack: Release MR restrack when delete {CVE-2022-50822}
  - RDMA/irdma: Fix memory leak of PBLE objects {CVE-2023-54055}
  - wifi: ath11k: Fix memory leak in ath11k_peer_rx_frag_setup {CVE-2023-54275}
  - mptcp: stricter state check in mptcp_worker {CVE-2023-54176}
  - nfsd: provide locking for v4_end_grace {CVE-2026-22980}
  - iommu: disable SVA when CONFIG_X86 is set {CVE-2025-71089}
  - net: atlantic: add check for MAX_SKB_FRAGS {CVE-2025-68301}
  - net: atlantic: reduce scope of is_rsc_complete
  - atlantic: Fix buff_ring OOB in aq_ring_rx_clean
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies {CVE-2025-40096}
  - net: phy: xgmiitorgmii: Fix refcount leak in xgmiitorgmii_probe {CVE-2022-50777}
  - wifi: rt2x00: Fix memory leak when handling surveys {CVE-2023-54131}
  - wifi: ath9k: hif_usb: fix memory leak of urbs in ath9k_hif_usb_dealloc_tx_urbs() {CVE-2022-50740}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() {CVE-2026-23193}
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure {CVE-2026-23144}
  - ACPICA: Fix use-after-free in acpi_ut_copy_ipackage_to_ipackage() {CVE-2022-50423}
  - wifi: ath10k: fix dma_free_coherent() pointer {CVE-2026-23133}
  - bpf: Move bpf map owner out of common struct {CVE-2025-38502}
  - fs: Lock moved directories
  - fs: Establish locking order for unrelated directories
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats {CVE-2025-68800}
  - macvlan: fix possible UAF in macvlan_forward_source() {CVE-2026-23001}
  - HID: uclogic: Correct devm device reference for hidinput input_dev name {CVE-2023-54207}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() {CVE-2026-22984}
  - ppp: fix memory leak in pad_compress_skb {CVE-2025-39847}
  - migrate: correct lock ordering for hugetlb file folios {CVE-2026-23097}
  - keys: Fix linking a duplicate key to a keyring's assoc_array {CVE-2023-54170}
  - scsi: qla4xxx: Add length check when parsing nlattrs {CVE-2023-53456}
  - scsi: mpi3mr: Fix issues in mpi3mr_get_all_tgt_info() {CVE-2023-53320}
  - wifi: ath11k: fix registration of 6Ghz-only phy without the full channel range {CVE-2023-54229}
  - wifi: iwlwifi: pcie: fix possible NULL pointer dereference {CVE-2023-54053}
  - dm flakey: don't corrupt the zero page {CVE-2023-54317}
  - md/raid10: fix memleak for 'conf->bio_split' {CVE-2023-54123}
  - crypto: qat - fix out-of-bounds read {CVE-2023-54325}
  - drm/nouveau/kms/nv50-: init hpd_irq_lock for PIOR DP {CVE-2023-54263}
  - ipmi:ssif: Fix a memory leak when scanning for an adapter {CVE-2023-54064}
  - Revert "Bluetooth: btsdio: fix use after free bug in btsdio_remove due to unfinished work" {CVE-2023-54197}
  - netfilter: nf_tables: always release netdev hooks from notifier {CVE-2023-54200}
  - wifi: iwlwifi: fix iwl_mvm_max_amsdu_size() for MLO {CVE-2023-54029}
  - serial: arc_uart: fix of_iomap leak in `arc_serial_probe` {CVE-2023-53719}
  - soundwire: bus: Fix unbalanced pm_runtime_put() causing usage count underflow {CVE-2023-54259}
  - vfio/type1: fix cap_migration information leak {CVE-2023-54137}
  - drm/client: Fix memory leak in drm_client_target_cloned {CVE-2023-54091}
  - RDMA: hfi1: fix possible divide-by-zero in find_hw_thread_mask() {CVE-2025-39742}
  - crypto: ccp - Fix crash when rebind ccp device for ccp.ko {CVE-2025-38581}
  - iwlwifi: Add missing check for alloc_ordered_workqueue {CVE-2025-38602}
  - net: bridge: fix soft lockup in br_multicast_query_expired() {CVE-2025-39773}
  - net: drop UFO packets in udp_rcv_segment() {CVE-2025-38622}
  - iommu: Fix error unwind in iommu_group_alloc() {CVE-2023-53482}
  - qed: allow sleep in qed_mcp_trace_dump() {CVE-2023-53509}
  - cifs: Fix xid leak in cifs_flock() {CVE-2022-50460}
  - platform/x86: dell-sysman: Fix reference leak {CVE-2023-53631}
  - scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure {CVE-2025-38695}
  - bpf, ktls: Fix data corruption when using bpf_msg_pop_data() in ktls {CVE-2025-38608}
  - bpf: prevent decl_tag from being referenced in func_proto {CVE-2022-50862}
  - mm/kmemleak: avoid deadlock by moving pr_warn() outside kmemleak_lock {CVE-2025-39736}
  - mm/kmemleak: avoid soft lockup in __kmemleak_do_cleanup() {CVE-2025-39737}
  - drm/amd/display: Fix potential null dereference {CVE-2023-53498}
  - x86/MCE/AMD: Use an u64 for bank_map {CVE-2023-53474}
  - kobject: Add sanity check for kset->kobj.ktype in kset_register() {CVE-2023-53480}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els31]
changelog:
  - rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
  - xfrm: esp: avoid in-place decrypt on shared skb frags
  - clk: Fix clk_hw_get_clk() when dev is NULL {CVE-2022-49187}
  - x86/sgx: Add overflow check in sgx_validate_offset_length() {CVE-2022-49785}
  - ext4: init quota for 'old.inode' in 'ext4_rename' {CVE-2022-50346}
  - skbuff: Account for tail adjustment during pull operations {CVE-2022-50365}
  - net: If sock is dead don't access sock's sk_wq in sk_stream_wait_memory {CVE-2022-50409}
  - scsi: qla2xxx: Delay module unload while fabric scan in progress {CVE-2025-71235}
  - HID: alps: fix NULL pointer dereference in alps_raw_event() {CVE-2026-31625}
  - rxrpc: fix reference count leak in rxrpc_server_keyring() {CVE-2026-31634}
  - drm/i915/gt: Check set_default_submission() before deferencing {CVE-2026-31540}
  - ACPICA: ACPICA: check null return of ACPI_ALLOCATE_ZEROED in acpi_db_display_objects {CVE-2023-54010}
  - drm/amdgpu: fix the waring dereferencing hive {CVE-2024-46805}
  - drm/amd/display: Add NULL check for function pointer in dcn20_set_output_transfer_func {CVE-2024-49911}
  - tracing: Prevent bad count for tracing_cpumask_write {CVE-2024-56763}
  - HID: wacom: fix when get product name maybe null pointer {CVE-2024-56629}
  - thermal: int340x: Add NULL check for adev {CVE-2025-23136}
  - wifi: mac80211: Purge vif txq in ieee80211_do_stop() {CVE-2025-37794}
  - Bluetooth: L2CAP: Fix null-ptr-deref on l2cap_sock_ready_cb {CVE-2026-31510}
  - wifi: cfg80211: ocb: don't leave if not joined {CVE-2023-53992}
  - mmc: core: Fix kernel panic when remove non-standard SDIO card {CVE-2022-50640}
  - EDAC/i10nm: fix refcount leak in pci_get_dev_wrapper() {CVE-2022-50645}
  - serial: amba-pl011: avoid SBSA UART accessing DMACR register {CVE-2022-50625}
  - inet_diag: Initialize pad field in struct inet_diag_req_v2 {CVE-2024-42106}
  - regulator: pfuze100: Fix refcount leak in pfuze_parse_regulators_dt {CVE-2022-49481}
  - net/core: Fix ETH_P_1588 flow dissector {CVE-2023-52580}
  - mm/damon/vaddr-test: fix memory leak in damon_do_test_apply_three_regions() {CVE-2023-52560}
  - af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg {CVE-2024-38596}
  - drm/amd/display: Implement bounds check for stream encoder creation in DCN301 {CVE-2024-26660}
  - block: prevent division by zero in blk_rq_stat_sum() {CVE-2024-35925}
  - netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu() {CVE-2024-36286}
  - tipc: fix a possible memleak in tipc_buf_append {CVE-2024-36954}
  - ipv6: prevent possible NULL deref in fib6_nh_init() {CVE-2024-40961}
  - pinctrl: fix deadlock in create_pinctrl() when handling -EPROBE_DEFER {CVE-2024-42090}
  - ipv6: prevent possible NULL dereference in rt6_probe() {CVE-2024-40960}
  - drm/radeon: check bo_va->bo is non-NULL before using it {CVE-2024-41060}
  - dma: fix call order in dmam_free_coherent {CVE-2024-43856}
  - scsi: qla2xxx: Fix for possible memory corruption {CVE-2024-42288}
  - ext4: avoid dividing by 0 in mb_update_avg_fragment_size() when block bitmap corrupt {CVE-2024-26774}
  - netfilter: flowtable: incorrect pppoe tuple {CVE-2024-27015}
  - bnxt_en: Adjust logging of firmware messages in case of released token in __hwrm_send() {CVE-2024-40919}
  - Bluetooth: btintel: Fix null ptr deref in btintel_read_version {CVE-2024-35933}
  - netdevsim: prevent bad user input in nsim_dev_health_break_write() {CVE-2024-56716}
  - net/mlx5e: CT: Fix null-ptr-deref in add rule err flow {CVE-2024-53120}
  - EDAC/bluefield: Fix potential integer overflow {CVE-2024-53161}
  - NFSD: Prevent NULL dereference in nfsd4_process_cb_update() {CVE-2024-53217}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() {CVE-2024-50304}
  - blk-rq-qos: fix crash on rq_qos_wait vs. rq_qos_wake_function race {CVE-2024-50082}
  - drm/radeon: fix uninitialized size issue in radeon_vce_cs_parse() {CVE-2025-21996}
  - HID: appleir: Fix potential NULL dereference at raw event handle {CVE-2025-21948}
  - filemap: Fix bounds checking in filemap_read() {CVE-2024-50272}
  - efi: fix potential NULL deref in efi_mem_reserve_persistent {CVE-2023-52976}
  - perf/x86/amd: fix potential integer overflow on shift of a int {CVE-2022-49748}
  - ext4: fix infinite loop when replaying fast_commit {CVE-2024-43828}
  - kthread: unpark only parked kthread {CVE-2024-50019}
  - xhci: tegra: fix checked USB2 port number {CVE-2024-50075}
  - Bluetooth: Call iso_exit() on module unload {CVE-2024-50078}
  - scsi: target: core: Fix null-ptr-deref in target_alloc_device() {CVE-2024-50153}
  - drm/radeon: Fix encoder->possible_clones {CVE-2024-50201}
  - squashfs: harden sanity check in squashfs_read_xattr_id_table {CVE-2023-52979}
  - xsk: fix an integer overflow in xp_create_and_assign_umem() {CVE-2025-21997}
  - can: j1939: j1939_session_new(): fix skb reference counting {CVE-2024-56645}
  - ice: Do not use WQ_MEM_RECLAIM flag for workqueue {CVE-2023-52743}
  - ALSA: usx2y: Use snd_card_free_when_closed() at disconnection {CVE-2024-56533}
  - sched/core: Prevent rescheduling when interrupts are disabled {CVE-2024-58090}
  - HID: core: Fix assumption that Resolution Multipliers must be in Logical Collections {CVE-2024-57986}
  - RDMA/mlx5: Fix mlx5_poll_one() cur_qp update flow {CVE-2025-22086}
  - x86/mm: Fix flush_tlb_range() when used for zapping normal PMDs {CVE-2025-22045}
  - Bluetooth: btrtl: Prevent potential NULL dereference {CVE-2025-37792}
  - tracing/histograms: Fix memory leak problem {CVE-2022-49648}
  - net: hns3: make sure ptp clock is unregister and freed if hclge_ptp_get_cycle returns an error {CVE-2025-21924}
  - ext4: fix another off-by-one fsmap error on 1k block filesystems {CVE-2023-53143}
  - can: mcp251x: fix deadlock if an interrupt occurs during mcp251x_open {CVE-2024-46791}
  - crypto: ecdh - explicitly zeroize private_key {CVE-2024-42098}
  - acpi: nfit: fix narrowing conversion in acpi_nfit_ctl {CVE-2025-22044}
  - geneve: do not assume mac header is set in geneve_xmit_skb() {CVE-2024-56636}
  - tracing/timerlat: Fix a race during cpuhp processing {CVE-2024-49866}
  - x86/mtrr: Check if fixed MTRRs exist before saving them {CVE-2024-44948}
  - genirq/irq_sim: Initialize work context pointers properly {CVE-2025-38408}
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() {CVE-2025-38664}
  - mm/ksm: fix flag-dropping behavior in ksm_madvise {CVE-2025-40040}
  - objtool: Fix SEGFAULT {CVE-2022-50879}
  - tty: synclink_gt: Fix null-pointer-dereference in slgt_clean() {CVE-2022-49307}
  - can: af_can: fix NULL pointer dereference in can_rx_register() {CVE-2022-49863}
  - bnxt_en: Fix possible crash in bnxt_hwrm_set_coal() {CVE-2022-49869}
  - pinctrl: devicetree: fix null pointer dereferencing in pinctrl_dt_to_map {CVE-2022-49832}
  - tty: vt: initialize unicode screen buffer {CVE-2022-50222}
  - mfd: max77620: Fix refcount leak in max77620_initialise_fps {CVE-2022-50108}
  - pnode: terminate at peers of source {CVE-2022-50280}
  - mm: /proc/pid/smaps_rollup: fix no vma's null-deref {CVE-2022-50380}
  - chardev: fix error handling in cdev_device_add() {CVE-2022-50282}
  - net: hinic: fix the issue of CMDQ memory leaks {CVE-2022-50387}
  - misc: tifm: fix possible memory leak in tifm_7xx1_switch_media() {CVE-2022-50349}
  - tracing: Do not register unsupported perf events {CVE-2025-71125}
  - ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
  - can: j1939: make j1939_session_activate() fail if device is no longer registered {CVE-2025-71182}
  - net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
  - RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
  - udp_tunnel: fix NULL deref caused by udp_sock_create6 when CONFIG_IPV6=n {CVE-2026-23439}
  - xfrm: clear trailing padding in build_polexpire() {CVE-2026-31664}
  - wifi: rt2x00usb: fix devres lifetime {CVE-2026-31672}
  - mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
  - wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
  - Bluetooth: RFCOMM: FIX possible deadlock in rfcomm_sk_state_change {CVE-2024-50044}
  - drm/nouveau/dispnv04: fix null pointer dereference in nv17_tv_get_ld_modes {CVE-2024-41095}
  - smb: client: fix deadlock in smb2_find_smb_tcon() {CVE-2024-39468}
  - drm/amdgpu: Fixed bug on error when unloading amdgpu {CVE-2023-52912}
  - usb: typec: ucsi: Fix null pointer dereference in trace {CVE-2024-46719}
  - drm/amdgpu: the warning dereferencing obj for nbio_v7_4 {CVE-2024-46819}
  - netfilter: flowtable: initialise extack before use {CVE-2024-45018}
  - lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc() {CVE-2024-47668}
  - drm/amd/display: Check null pointer before dereferencing se {CVE-2024-50049}
  - efistub/tpm: Use ACPI reclaim memory for event log to avoid corruption {CVE-2024-49858}
  - drm/amd/pm: ensure the fw_info is not null before using it {CVE-2024-49890}
  - wifi: iwlwifi: mvm: pause TCM when the firmware is stopped {CVE-2024-47673}
  - ACPICA: check null return of ACPI_ALLOCATE_ZEROED() in acpi_db_convert_to_package() {CVE-2024-49962}
  - drm/amd/display: Check stream before comparing them {CVE-2024-49896}
  - wifi: brcmfmac: Fix oops due to NULL pointer dereference in brcmf_sdiod_sglist_rw() {CVE-2024-56593}
  - USB: serial: quatech2: fix null-ptr-deref in qt2_process_read_urb() {CVE-2025-21689}
  - sctp: properly validate chunk size in sctp_sf_ootb() {CVE-2024-50299}
  - USB: usbtmc: prevent kernel-usb-infoleak {CVE-2024-47671}
  - printk: Fix signed integer overflow when defining LOG_BUF_LEN_MAX {CVE-2024-58017}
  - nfp: bpf: Add check for nfp_app_ctrl_msg_alloc() {CVE-2025-21848}
  - kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
  - linux/dim: Fix divide by 0 in RDMA DIM {CVE-2022-49670}
  - scsi: st: Fix array overflow in st_setup() {CVE-2025-37857}
  - usb: typec: wusb3801: fix fwnode refcount leak in wusb3801_probe() {CVE-2022-50825}
  - samples/bpf: Fix buffer overflow in tcp_basertt {CVE-2023-54312}
  - debugobjects: Don't wake up kswapd from fill_pool() {CVE-2023-54268}
  - regmap-irq: Fix out-of-bounds access when allocating config buffers {CVE-2023-53768}
  - RDMA/core: Fix GID entry ref leak when create_ah fails {CVE-2023-54003}
  - drm: Don't unref the same fb many times by mistake due to deadlock handling {CVE-2023-52486}
  - pstore/ram: Fix crash when setting number of cpus to an odd number {CVE-2023-52619}
  - net: usb: qmi_wwan: fix memory leak for not ip packets {CVE-2024-43861}
  - HID: i2c-hid-of: fix NULL-deref on failed power up {CVE-2024-26717}
  - netfilter: nf_tables: set dormant flag on hook register failure {CVE-2024-26835}
  - md: fix kmemleak of rdev->serial {CVE-2024-26900}
  - spi: fix null pointer dereference within spi_sync {CVE-2024-36930}
  - scsi: qedf: Fix a possible memory leak in qedf_alloc_and_init_sb() {CVE-2024-56748}
  - scsi: qedi: Fix a possible memory leak in qedi_alloc_and_init_sb() {CVE-2024-56747}
  - sunrpc: clear XPRT_SOCK_UPD_TIMEOUT when reset transport {CVE-2024-56688}
  - gfs2: Truncate address space when flipping GFS2_DIF_JDATA flag {CVE-2025-21699}
  - sock_map: Add a cond_resched() in sock_hash_free() {CVE-2024-47710}
  - net: stmmac: Fix zero-division error when disabling tc cbs {CVE-2024-49977}
  - net/mlx5: Fix error path in multi-packet WQE transmit {CVE-2024-50001}
  - HID: core: remove unnecessary WARN_ON() in implement() {CVE-2024-39509}
  - tipc: fix memory leak in tipc_link_xmit {CVE-2025-37757}
  - ima: Fix potential memory leak in ima_init_crypto() {CVE-2022-49627}
  - net: tun: unlink NAPI from device on destruction {CVE-2022-49672}
  - iommu/amd: Fix pci device refcount leak in ppr_notifier() {CVE-2022-50505}
  - rxrpc: Fix bug due to prealloc collision {CVE-2025-38544}
  - ext4: zero i_disksize when initializing the bootloader inode {CVE-2023-53101}
  - scsi: hisi_sas: Add cond_resched() for no forced preemption model {CVE-2024-56589}
  - net: fix NULL pointer dereference in l3mdev_l3_rcv {CVE-2025-22103}
  - cxgb4: fix memory leak in cxgb4_init_ethtool_filters() error path {CVE-2025-37788}
  - drm/amdgpu: fix amdgpu_irq_put call trace in gmc_v11_0_hw_fini {CVE-2023-53237}
  - samples/bpf: Fix fout leak in hbm's run_bpf_prog {CVE-2023-53290}
  - regulator: core: fix NULL dereference on unbind due to stale coupling data {CVE-2025-38668}
  - PM / devfreq: Fix leak in devfreq_dev_release() {CVE-2023-53518}
  - coresight: trbe: remove cpuhp instance node before remove cpuhp state {CVE-2022-50319}
  - net: phy: fix null-ptr-deref while probe() failed {CVE-2022-49021}
  - iommu/vt-d: Fix PCI device refcount leak in dmar_dev_scope_init() {CVE-2022-49002}
  - mac802154: fix missing INIT_LIST_HEAD in ieee802154_if_add() {CVE-2022-48972}
  - watch_queue: Free the page array when watch_queue is dismantled {CVE-2022-49148}
  - samples/landlock: Fix path_list memory leak {CVE-2021-47654}
  - net: tun: Fix memory leaks of napi_get_frags {CVE-2022-49871}
  - ftrace: Fix null pointer dereference in ftrace_add_mod() {CVE-2022-49802}
  - netdevsim: Fix memory leak of nsim_dev->fa_cookie {CVE-2022-49803}
  - tracing: Fix memory leak in tracing_read_pipe() {CVE-2022-49801}
  - mtd: core: fix possible resource leak in init_mtd() {CVE-2022-50304}
  - wifi: brcmfmac: fix potential memory leak in brcmf_netdev_start_xmit() {CVE-2022-50321}
  - xfrm_user: fix info leak in build_report() {CVE-2026-31671}
  - regulator: core: fix resource leak in regulator_register() {CVE-2022-50724}
  - x86/tdx: Fix data leak in mmio_read() {CVE-2024-46794}
  - x86/entry: Clear X86_FEATURE_SMAP when CONFIG_X86_SMAP=n {CVE-2021-47430}
  - ceph: remove the incorrect Fw reference check when dirtying pages {CVE-2024-50179}
  - nfs: Fix KMSAN warning in decode_getfattr_attrs() {CVE-2024-53066}
  - blk-cgroup: Fix class @block_class's subsystem refcount leakage {CVE-2025-21745}
  - cifs: Fix lost destroy smbd connection when MR allocate failed {CVE-2023-54260}
  - cifs: Fix xid leak in cifs_ses_add_channel() {CVE-2022-50856}
  - phy: tegra: xusb: Clear the driver reference in usb-phy dev {CVE-2023-54083}
  - drm/ttm: Don't leak a resource on swapout move error {CVE-2023-53844}
  - team: Move team device type change at the end of team_port_add {CVE-2025-68340}
  - udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
  - KVM: SEV: Protect *all* of sev_mem_enc_register_region() with kvm->lock {CVE-2026-31592}
  - HID: core: clamp report_size in s32ton() to avoid undefined shift {CVE-2026-31624}
  - af_key: validate families in pfkey_send_migrate() {CVE-2026-31515}
  - nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
  - module: Fix kernel panic when a symbol st_shndx is out of bounds {CVE-2026-31521}
  - ALSA: 6fire: fix use-after-free on disconnect {CVE-2026-31581}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els32]
changelog:
  - net: skbuff: propagate shared-frag marker through pskb_copy()
  - HID: ignore non-functional sensor in HP 5MP Camera {CVE-2025-21992}
  - net: fix crash when config small gso_max_size/gso_ipv4_max_size {CVE-2024-50258}
  - ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_init_flow() {CVE-2024-53042}
  - ALSA: ctxfi: Limit PTP to a single page {CVE-2026-31602}
  - serial: imx: Add missing .thaw_noirq hook {CVE-2022-49841}
  - module: ensure that kobject_put() is safe for module type kobjects {CVE-2025-37995}
  - udf: Fix uninitialized array access for some pathnames {CVE-2023-53165}
  - ACPICA: Avoid undefined behavior: applying zero offset to null pointer {CVE-2023-53182}
  - net: bridge: fix nd_tbl NULL dereference when IPv6 is disabled {CVE-2026-23381}
  - platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
  - HID: Add HID_CLAIMED_INPUT guards in raw_event callbacks missing them {CVE-2026-23382}
  - icmp: fix NULL pointer dereference in icmp_tag_validation() {CVE-2026-23398}
  - net/sched: ets: fix divide by zero in the offload path {CVE-2026-23379}
  - ice: Fix memory leak in ice_set_ringparam() {CVE-2026-23389}
  - wifi: radiotap: reject radiotap with unknown bits {CVE-2026-23367}
  - HID: asus: avoid memory leak in asus_report_fixup() {CVE-2026-31524}
  - xprtrdma: treat all calls not a bcall when bc_serv is NULL {CVE-2022-49321}
  - mm/mempolicy: fix uninit-value in mpol_rebind_policy() {CVE-2022-49567}
  - x86/MCE/AMD: Fix memory leak when threshold_create_bank() fails {CVE-2022-49549}
  - af_unix: Fix a data-race in unix_dgram_peer_wake_me(). {CVE-2022-49344}
  - bpf, sockmap: Fix repeated calls to sock_put() when msg has more_data {CVE-2022-50536}
  - net: qrtr: Fix an uninit variable access bug in qrtr_tx_resume() {CVE-2023-53578}
  - wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems() {CVE-2023-53570}
  - mptcp: fix race on unaccepted mptcp sockets {CVE-2022-49669}
  - ALSA: usb-audio: Use correct version for UAC3 header validation {CVE-2026-23318}
  - wifi: mt76: Fix possible oob access in mt76_connac2_mac_write_txwi_80211() {CVE-2026-23315}
  - net: usb: cdc_ncm: add ndpoffset to NDP32 nframes bounds check {CVE-2026-23447}
  - Squashfs: check metadata block offset is within range {CVE-2026-23388}
  - apparmor: Fix double free of ns_name in aa_replace_profiles() {CVE-2026-23408}
  - nfnetlink_osf: validate individual option lengths in fingerprints {CVE-2026-23397}
  - i2c: piix4: Fix a memory leak in the EFCH MMIO support {CVE-2022-49653}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els34]
changelog:
  - net: skbuff: propagate shared-frag marker through skb_gro_receive + skb_shift {CVE-2026-46300}
  - Revert "net: gro: propagate SKBFL_SHARED_FRAG through skb_gro_receive"


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els5]
changelog:
  - af_unix: Fix garbage collector racing against connect() {CVE-2024-26923}
  - netfilter: nft_limit: reject configurations that cause integer overflow {CVE-2024-26668}
  - libbpf: Fix use-after-free in btf_dump_name_dups {CVE-2022-3534}
  - bpf: Fix partial dynptr stack slot reads/writes {CVE-2023-39191}
  - ima: Fix use-after-free on a dentry's dname.name {CVE-2024-39494}
  - ima: define ima_max_digest_data struct without a flexible array variable
  - ima: detect changes to the backing overlay file
  - tpm: fix reference counting for struct tpm_chip {CVE-2022-2977}
  - tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux {CVE-2023-6546}
  - tty: n_gsm: fix restart handling via CLD command {CVE-2023-6546}
  - r8169: Fix possible ring buffer corruption on fragmented Tx packets. {CVE-2024-38586}
  - netfilter: tproxy: bail out if IP has been disabled on the device {CVE-2024-36270}
  - tcp: Use refcount_inc_not_zero() in tcp_twsk_unique(). {CVE-2024-36904}
  - Bluetooth: Fix double free in hci_conn_cleanup {CVE-2023-28464}
  - fs,hugetlb: fix NULL pointer dereference in hugetlbs_fill_super {CVE-2024-0841}
  - net/ipv6: avoid possible UAF in ip6_route_mpath_notify() {CVE-2024-26852}
  - tipc: fix UAF in error path {CVE-2024-36886}
  - Bluetooth: af_bluetooth: Fix deadlock {CVE-2024-26886}
  - Bluetooth: af_bluetooth: Fix Use-After-Free in bt_sock_recvmsg {CVE-2023-51779}
  - dma-mapping: benchmark: handle NUMA_NO_NODE correctly {CVE-2024-39277}
  - net/mlx5e: Prevent deadlock while disabling aRFS {CVE-2024-27014}
  - net/mlx5e: Introduce flow steering API {CVE-2024-27014}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - RDMA/srpt: Support specifying the srpt_service_guid parameter {CVE-2024-26744}
  - platform/x86: think-lmi: Fix reference leak {CVE-2023-52520}
  - USB: usb-storage: Prevent divide-by-0 error in isd200_ata_command {CVE-2024-27059}
  - fat: fix uninitialized field in nostale filehandles {CVE-2024-26973}
  - usb: xhci: Add error handling in xhci_map_urb_for_dma {CVE-2024-26964}
  - wifi: ath9k: delay all of ath9k_wmi_event_tasklet() until init is complete {CVE-2024-26897}
  - wifi: mac80211: fix race condition on enabling fast-xmit {CVE-2024-26779}
  - RDMA/qedr: Fix qedr_create_user_qp error flow {CVE-2024-26743}
  - wifi: iwlwifi: fix a memory corruption {CVE-2024-26610}
  - x86/fpu: Stop relying on userspace for info to fault in xsave buffer {CVE-2024-26603}
  - wifi: rt2x00: restart beacon queue when hardware reset {CVE-2023-52595}
  - wifi: ath9k: Fix potential array-index-out-of-bounds read in ath9k_htc_txstatus() {CVE-2023-52594}
  - net: usb: smsc75xx: Fix uninit-value access in __smsc75xx_read_reg {CVE-2023-52528}
  - RDMA/siw: Fix connection failure handling {CVE-2023-52513}
  - usb: hub: Guard against accesses to uninitialized BOS descriptors {CVE-2023-52477}
  - tty: tty_buffer: Fix the softlockup issue in flush_to_ldisc {CVE-2021-47185}
  - sctp: fail if no bound addresses can be used for a given scope {CVE-2023-1074}
  - memcg: enable accounting for file lock caches {CVE-2022-0480}
  - net/tls: do not free tls_rec on async operation in bpf_exec_tx_verdict() {CVE-2023-6176}
  - RDMA/srpt: Do not register event handler until srpt device is fully setup {CVE-2024-26872}
  - drm/amd/display: Atom Integrated System Info v2_2 for DCN35 {CVE-2024-36897}
  - net/mlx5e: fix a potential double-free in fs_any_create_groups {CVE-2023-52667}
  - ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action() {CVE-2024-36902}
  - ipv6: prevent NULL dereference in ip6_output() {CVE-2024-36901}
  - vt: fix memory overlapping when deleting chars in the buffer {CVE-2022-48627}
  - hwmon: (coretemp) Fix out-of-bounds memory access {CVE-2024-26664}
  - i2c: Fix a potential use after free {CVE-2019-25162}
  - net/smc: fix illegal rmb_desc access in SMC-D connection dump {CVE-2024-26615}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els6]
changelog:
  - tun: add missing verification for short frame {CVE-2024-41091}
  - tap: add missing verification for short frame {CVE-2024-41090}
  - drm/amd/display: Fix potential index out of bounds in color transformation function {CVE-2024-38552}
  - net: fix __dst_negative_advice() race {CVE-2024-36971}
  - net: annotate data-races around sk->sk_dst_pending_confirm {CVE-2024-36971}
  - net: fix out-of-bounds access in ops_init {CVE-2024-36883}
  - net/sched: flower: Fix chain template offload {CVE-2024-26669}
  - netfilter: nf_tables: use timestamp to check for set element timeout {CVE-2024-27397}
  - netfilter: nft_set_rbtree: Remove unused variable nft_net {CVE-2024-27397}
  - netfilter: nft_set_rbtree: prefer sync gc to async worker {CVE-2024-27397}
  - netfilter: nft_set_rbtree: rename gc deactivate+erase function {CVE-2024-27397}
  - netfilter: nf_tables: de-constify set commit ops function argument {CVE-2024-27397}
  - netfilter: nft_set_rbtree: .deactivate fails if element has expired {CVE-2024-27397}
  - sched/membarrier: reduce the ability to hammer on sys_membarrier {CVE-2024-26602}
  - drm/vmwgfx: Fix possible null pointer derefence with invalid contexts {CVE-2022-38096}
  - sched/psi: Fix use-after-free in ep_remove_wait_queue() {CVE-2023-52707}
  - wait: add wake_up_pollfree() {CVE-2023-52707}
  - x86/sev: Check for user-space IOIO pointing to kernel space {CVE-2023-46813}
  - x86/sev: Check IOBM for IOIO exceptions from user-space {CVE-2023-46813}
  - x86/sev: Disable MMIO emulation from user mode {CVE-2023-46813}
  - tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). {CVE-2024-37356}
  - blk-cgroup: fix list corruption from reorder of WRITE ->lqueued {CVE-2024-38384}
  - netfilter: complete validation of user input {CVE-2024-35962}
  - SUNRPC: Fix UAF in svc_tcp_listen_data_ready() {CVE-2023-52885}
  - PM / devfreq: Synchronize devfreq_monitor_[start/stop] {CVE-2023-52635}
  - netfilter: validate user input for expected length {CVE-2024-35896}
  - virtio: delete vq in vp_find_vqs_msix() when request_irq() fails {CVE-2024-37353}
  - bnxt: prevent skb UAF after handing over to PTP worker {CVE-2022-48637}
  - net: openvswitch: fix overwriting ct original tuple for ICMPv6 {CVE-2024-38558}
  - net: core: reject skb_copy(_expand) for fraglist GSO skbs {CVE-2024-36929}
  - rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation {CVE-2024-36017}
  - ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound {CVE-2024-33621}
  - drm/vmwgfx: Fix invalid reads in fence signaled events {CVE-2024-36960}
  - gro: fix ownership transfer {CVE-2024-35890}
  - mlxbf_gige: stop interface during shutdown {CVE-2024-35885}
  - scsi: libfc: Fix potential NULL pointer dereference in fc_lport_ptp_setup() {CVE-2023-52809}
  - wifi: mt76: replace skb_put with skb_put_zero {CVE-2024-42225}
  - drm/amdgpu: Using uninitialized value *size when calling amdgpu_vce_cs_reloc {CVE-2024-42228}
  - scsi: mpi3mr: Sanitise num_phys {CVE-2024-42159}
  - bpf: Avoid uninitialized value in BPF_CORE_READ_BITFIELD {CVE-2024-42161}
  - drm/amdgpu/mes: fix use-after-free issue {CVE-2024-38581}
  - i40e: fix vf may be used uninitialized in this function warning {CVE-2024-36020}
  - vt: fix unicode buffer corruption when deleting characters {CVE-2024-35823}
  - ata: libata-core: Fix double free on error {CVE-2024-41087}
  - netfilter: nf_tables: release mutex after nft_gc_seq_end from abort path {CVE-2024-26925}
  - tcp_metrics: validate source addr length {CVE-2024-42154}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els7]
changelog:
  - tipc: Return non-zero value from tipc_udp_addr2str() on error {CVE-2024-42284}
  - dev/parport: fix the array out-of-bounds risk {CVE-2024-42301}
  - RDMA/iwcm: Fix a use-after-free related to destroying CM IDs {CVE-2024-42285}
  - scsi: aacraid: Fix double-free on probe failure {CVE-2024-46673}
  - ipv6: prevent UAF in ip6_send_skb() {CVE-2024-44987}
  - block/ioctl: prefer different overflow check {CVE-2024-41000}
  - ACPICA: Revert "ACPICA: avoid Info: mapping multiple BARs. Your kernel is fine." {CVE-2024-40984}
  - net/sched: Fix UAF when resolving a clash {CVE-2024-41040}
  - nvme: avoid double free special payload {CVE-2024-41073}
  - x86/tdx: Allow 32-bit emulation by default {CVE-2024-25744}
  - x86/entry: Do not allow external 0x80 interrupts {CVE-2024-25742}
  - x86/entry: Convert INT 0x80 emulation to IDTENTRY {CVE-2024-25742}
  - x86/coco: Disable 32-bit emulation by default on TDX and SEV {CVE-2024-25742}
  - x86: Make IA32_EMULATION boot time configurable {CVE-2024-25744}
  - x86/entry: Make IA32 syscalls' availability depend on ia32_enabled() {CVE-2024-25744}
  - x86/elf: Make loading of 32bit processes depend on ia32_enabled() {CVE-2024-25744}
  - x86/entry: Compile entry_SYSCALL32_ignore() unconditionally {CVE-2024-25744}
  - x86/entry: Rename ignore_sysret() {CVE-2024-25744}
  - x86/cpu: Don't write CSTAR MSR on Intel CPUs {CVE-2024-25744}
  - x86: Introduce ia32_enabled() {CVE-2024-25742}
  - x86: Fix misspelled Kconfig symbols {CVE-2024-25744}
  - x86/sev: Harden #VC instruction emulation somewhat {CVE-2024-25742}
  - objtool: Add entry UNRET validation {CVE-2024-25744}
  - x86/cpu: Switch to arch_cpu_finalize_init() {CVE-2022-40982}
  - init: Provide arch_cpu_finalize_init() {CVE-2022-40982}
  - gfs2: Fix potential glock use-after-free on unmount {CVE-2024-38570}
  - gfs2: Rename sd_{ glock => kill }_wait {CVE-2024-38570}
  - gfs2: Remove ill-placed consistency check {CVE-2024-38570}
  - gfs2: simplify gdlm_put_lock with out_free label {CVE-2024-38570}
  - dmaengine: idxd: Fix possible Use-After-Free in irq_process_work_list {CVE-2024-40956}
  - drm/amdgpu: add error handle to avoid out-of-bounds {CVE-2024-39471}
  - net/mlx5: Discard command completions in internal error {CVE-2024-38555}
  - net: bridge: xmit: make sure we have at least eth header len bytes {CVE-2024-38538}
  - netfilter: nftables: exthdr: fix 4-byte stack OOB write {CVE-2023-52628}
  - perf/core: Fix potential NULL deref {CVE-2023-5717}
  - perf: Disallow mis-matched inherited group reads {CVE-2023-5717}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els8]
changelog:
  - drm/amd/pm: Fix negative array index read {CVE-2024-46821}
  - drm/amd/display: Check gpio_id before used as array index {CVE-2024-46818}
  - drm/amd/display: Check link_index before accessing dc->links[] {CVE-2024-46813}
  - drm/amd/display: Fix index may exceed array range within fpu_update_bw_bounding_box {CVE-2024-46811}
  - Squashfs: sanity check symbolic link size {CVE-2024-46744}
  - platform/x86: panasonic-laptop: Fix SINF array out of bounds accesses {CVE-2024-46859}
  - net/sched: act_api: fix possible infinite loop in tcf_idr_check_alloc() {CVE-2024-40995}
  - net/sched: act_api: rely on rcu in tcf_idr_check_alloc {CVE-2024-40995}
  - netfilter: bridge: confirm multicast packets before passing them up the stack {CVE-2024-27415}
  - netfilter: let reset rules clean out conntrack entries {CVE-2024-27415}
  - mm/filemap: make MAX_PAGECACHE_ORDER acceptable to xarray {CVE-2024-42243}
  - gpiolib: cdev: Fix use after free in lineinfo_changed_notify {CVE-2024-36899}
  - bpf, sockmap: Prevent lock inversion deadlock in map delete elem {CVE-2024-35895}
  - bpf, sockmap: Fix preempt_rt splat when using raw_spin_lock_t {CVE-2024-35895}
  - mm/huge_memory: don't unpoison huge_zero_folio {CVE-2024-40914}
  - cxgb4: fix use after free bugs caused by circular dependency problem {CVE-2023-4133}
  - timers: Restore ABI Compatibility with timer_delete Functions {CVE-2023-4133}
  - timers: Provide timer_shutdown[_sync]() {CVE-2023-4133}
  - timers: Add shutdown mechanism to the internal functions {CVE-2023-4133}
  - timers: Split [try_to_]del_timer[_sync]() to prepare for shutdown mode {CVE-2023-4133}
  - timers: Silently ignore timers with a NULL function {CVE-2023-4133}
  - timers: Rename del_timer() to timer_delete() {CVE-2023-4133}
  - timers: Rename del_timer_sync() to timer_delete_sync() {CVE-2023-4133}
  - timers: Use del_timer_sync() even on UP {CVE-2023-4133}
  - timers: Update kernel-doc for various functions {CVE-2023-4133}
  - timers: Replace BUG_ON()s {CVE-2023-4133}
  - timers: Get rid of del_singleshot_timer_sync() {CVE-2023-4133}
  - clocksource/drivers/sp804: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - clocksource/drivers/arm_arch_timer: Do not use timer namespace for timer_shutdown() function {CVE-2023-4133}
  - mm: avoid overflows in dirty throttling logic {CVE-2024-42131}
  - ring-buffer: Fix a race between readers and resize checks {CVE-2024-38601}
  - igc: avoid returning frame twice in XDP_REDIRECT {CVE-2024-26853}
  - igc: Avoid transmit queue timeout for XDP {CVE-2024-26853}
  - nfsd: fix RELEASE_LOCKOWNER {CVE-2024-26629}
  - tty: n_gsm: require CAP_NET_ADMIN to attach N_GSM0710 ldisc {CVE-2023-52880}
  - nvmet: fix a possible leak when destroy a ctrl during qp establishment {CVE-2024-42152}
  - net: ntb_netdev: Move ntb_netdev_rx_handler() to call netif_rx() from __netif_rx() {CVE-2024-42110}
  - x86: stop playing stack games in profile_pc() {CVE-2024-42096}
  - xdp: Remove WARN() from __xdp_reg_mem_model() {CVE-2024-42082}
  - NFSv4: Fix memory leak in nfs4_set_security_label {CVE-2024-41076}
  - ppp: reject claimed-as-LCP but actually malformed packets {CVE-2024-41044}
  - udp: Set SOCK_RCU_FREE earlier in udp_lib_get_port(). {CVE-2024-41041}
  - sched/deadline: Fix task_struct reference leak {CVE-2024-41023}
  - tipc: force a dst refcount before doing decryption {CVE-2024-40983}
  - scsi: qedi: Fix crash while reading debugfs attribute {CVE-2024-40978}
  - wifi: iwlwifi: mvm: don't read past the mfuart notifcation {CVE-2024-40941}
  - wifi: iwlwifi: mvm: check n_ssids before accessing the ssids {CVE-2024-40929}
  - xhci: Handle TD clearing for multiple streams case {CVE-2024-40927}
  - wifi: mac80211: Fix deadlock in ieee80211_sta_ps_deliver_wakeup() {CVE-2024-40912}
  - wifi: cfg80211: Lock wiphy in cfg80211_get_station {CVE-2024-40911}
  - ipv6: fix possible race in __fib6_drop_pcpu_from() {CVE-2024-40905}
  - md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING {CVE-2024-39476}
  - usb-storage: alauda: Check whether the media is initialized {CVE-2024-38619}
  - usb-storage: alauda: Fix uninit-value in alauda_check_media() {CVE-2024-38619}
  - crypto: bcm - Fix pointer arithmetic {CVE-2024-38579}
  - scsi: qedf: Ensure the copied buf is NUL terminated {CVE-2024-38559}
  - wifi: nl80211: don't free NULL coalescing rule {CVE-2024-36941}
  - scsi: qla2xxx: Fix off by one in qla_edif_app_getstats() {CVE-2024-36025}
  - netfilter: nf_tables: Fix potential data-race in __nft_flowtable_type_get() {CVE-2024-35898}
  - mlxsw: spectrum_acl_tcam: Fix memory leak when canceling rehash work {CVE-2024-35852}
  - wifi: iwlwifi: dbg-tlv: ensure NUL termination {CVE-2024-35845}
  - KVM: SVM: Flush pages under kvm->lock to fix UAF in svm_register_enc_region() {CVE-2024-35791}
  - wifi: mac80211: check/clear fast rx for non-4addr sta VLAN changes {CVE-2024-35789}
  - wifi: rtl8xxxu: add cancel_work_sync() for c2hcmd_work {CVE-2024-27052}
  - nfp: flower: handle acti_netdevs allocation failure {CVE-2024-27046}
  - octeontx2-af: Use separate handlers for interrupts {CVE-2024-27030}
  - netfilter: flowtable: validate pppoe header {CVE-2024-27016}
  - kprobes/x86: Use copy_from_kernel_nofault() to read from unsafe address {CVE-2024-26946}
  - scsi: qla2xxx: Fix command flush on cable pull {CVE-2024-26931}
  - net: ice: Fix potential NULL pointer dereference in ice_bridge_setlink() {CVE-2024-26855}
  - bpf: Fix racing between bpf_timer_cancel_and_free and bpf_timer_cancel {CVE-2024-26737}
  - Input: cyapa - add missing input core locking to suspend/resume functions {CVE-2023-52884}
  - bpf, sockmap: Don't let sock_map_{close,destroy,unhash} call itself {CVE-2023-52735}
  - wifi: ath10k: fix NULL pointer dereference in ath10k_wmi_tlv_op_pull_mgmt_tx_compl_ev() {CVE-2023-52651}
  - net: tap_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - net: tun_chr_open(): set sk_uid from current_fsuid() {CVE-2023-4194}
  - seg6: fix the iif in the IPv6 socket control block {CVE-2021-47515}
  - tty: Fix out-of-bound vmalloc access in imageblit {CVE-2021-47383}
  - bnx2x: Fix multiple UBSAN array-index-out-of-bounds {CVE-2024-42148}
  - hwmon: (adc128d818) Fix underflows seen when writing limit attributes {CVE-2024-46759}
  - net: bridge: mst: fix vlan use-after-free {CVE-2024-36979}
  - stm class: Fix a double free in stm_register_device() {CVE-2024-38627}
  - wifi: mac80211: Avoid address calculations via out of bounds array indexing {CVE-2024-41071}
  - of/irq: Prevent device address out-of-bounds read in interrupt map walk {CVE-2024-46743}
  - HID: cougar: fix slab-out-of-bounds Read in cougar_report_fixup {CVE-2024-46747}
  - drm/amdgpu: fix mc_data out-of-bounds read warning {CVE-2024-46722}
  - drm/amdgpu: Fix out-of-bounds write warning {CVE-2024-46725}
  - drm/amdgpu: Fix out-of-bounds read of df_v1_7_channel_number {CVE-2024-46724}
  - wifi: nl80211: Avoid address calculations via out of bounds array indexing {CVE-2024-38562}
  - wifi: nl80211: convert cfg80211_scan_request allocation to *_size macros {CVE-2024-38562}
  - overflow: Implement size_t saturating arithmetic helpers {CVE-2024-38562}
  - cdrom: rearrange last_media_change check to avoid unintentional overflow {CVE-2024-42136}
  - ftrace: Fix possible use-after-free issue in ftrace_location() {CVE-2024-38588}
  - ftrace: Fix possible warning on checking all pages used in ftrace_process_locs() {CVE-2024-38588}
  - drm/amdgpu: fix ucode out-of-bounds read warning {CVE-2024-46723}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() {CVE-2024-46738}
  - sch/netem: fix use after free in netem_dequeue {CVE-2024-46800}
  - firmware: cs_dsp: Fix overflow checking of wmfw header {CVE-2024-41039}
  - hwmon: (lm95234) Fix underflows seen when writing limit attributes {CVE-2024-46758}
  - HID: amd_sfh: free driver_data after destroying hid device {CVE-2024-46746}
  - xfs: don't walk off the end of a directory data block {CVE-2024-41013}
  - hwmon: (w83627ehf) Fix underflows seen when writing limit attributes {CVE-2024-46756}
  - tunnels: fix out of bounds access when building IPv6 PMTU error {CVE-2024-26665}
  - hwmon: (nct6775-core) Fix underflows seen when writing limit attributes {CVE-2024-46757}
  - drm/amd/pm: fix the Out-of-bounds read warning {CVE-2024-46731}
  - drm/amdgpu/mes: fix mes ring buffer overflow {CVE-2024-46700}
  - exec: Fix ToCToU between perm check and set-uid/gid usage {CVE-2024-43882}
  - PCI/MSI: Fix UAF in msi_capability_init {CVE-2024-41096}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els9]
changelog:
  - smb: client: fix use-after-free in smb2_query_info_compound() {CVE-2023-52751}
  - smb: client: prevent new fids from being removed by laundromat {CVE-2023-52751}
  - cifs: fix dentry lookups in directory handle cache {CVE-2023-52751}
  - cifs: return a single-use cfid if we did not get a lease {CVE-2023-52751}
  - cifs: Check the lease context if we actually got a lease {CVE-2023-52751}
  - cifs: set rc to -ENOENT if we can not get a dentry for the cached dir {CVE-2023-52751}
  - cifs: use LIST_HEAD() and list_move() to simplify code {CVE-2023-52751}
  - cifs: fix wrong unlock before return from cifs_tree_connect() {CVE-2023-52751}
  - uprobe: avoid out-of-bounds memory access of fetching args {CVE-2024-50067}
  - net: do not delay dst_entries_add() in dst_release() {CVE-2024-50036}
  - smb: client: fix UAF in async decryption {CVE-2024-50047}
  - smb3: rename encryption/decryption TFMs
  - mm: call the security_mmap_file() LSM hook in remap_file_pages() {CVE-2024-47745}
  - ext4: avoid OOB when system.data xattr changes underneath the filesystem {CVE-2024-47701}
  - tty: n_gsm: Fix use-after-free in gsm_cleanup_mux {CVE-2024-50073}
  - driver core: bus: Fix double free in driver API bus_register() {CVE-2024-50055}
  - drm/amdkfd: amdkfd_free_gtt_mem clear the correct pointer {CVE-2024-49991}
  - drm/amd/display: fix double free issue during amdgpu module unload {CVE-2024-49989}
  - ext4: fix timer use-after-free on failed mount {CVE-2024-49960}
  - Bluetooth: L2CAP: Fix uaf in l2cap_connect {CVE-2024-49950}
  - Bluetooth: l2cap: Don't double set the HCI_CONN_MGMT_CONNECTED bit {CVE-2024-49950}
  - mptcp: pm: Fix uaf in __timer_delete_sync {CVE-2024-46858}
  - of: fdt: fix off-by-one error in unflatten_dt_nodes() {CVE-2022-48672}
  - filelock: fix potential use-after-free in posix_lock_inode {CVE-2024-41049}
  - locks: fix KASAN: use-after-free in trace_event_raw_event_filelock_lock {CVE-2024-41049}
  - drm/i915/gt: Fix potential UAF by revoke of fence registers {CVE-2024-41092}
  - ext4: no need to continue when the number of entries is 1 {CVE-2024-49967}
  - drm/amd/display: Fix index out of bounds in DCN30 degamma hardware format translation {CVE-2024-49895}
  - slip: make slhc_remember() more robust against malicious packets {CVE-2024-50033}
  - drm/amd/display: Fix index out of bounds in DCN30 color transformation {CVE-2024-49969}
  - drm/amd/display: Fix index out of bounds in degamma hardware format translation {CVE-2024-49894}
  - ext4: aovid use-after-free in ext4_ext_insert_extent() {CVE-2024-49883}
  - ACPI: sysfs: validate return type of _STR method {CVE-2024-49860}
  - ext4: fix double brelse() the buffer of the extents path {CVE-2024-49882}
  - tipc: guard against string buffer overrun {CVE-2024-49995}
  - drivers: media: dvb-frontends/rtl2832: fix an out-of-bounds write error {CVE-2024-47698}
  - firmware_loader: Block path traversal {CVE-2024-47742}
  - ppp: fix ppp_async_encode() illegal access {CVE-2024-50035}
  - netfilter: nf_reject_ipv6: fix nf_reject_ip6_tcphdr_put() {CVE-2024-47685}
  - ext4: fix slab-use-after-free in ext4_split_extent_at() {CVE-2024-49884}
  - drm/amd/display: Correct the defined value for AMDGPU_DMUB_NOTIFICATION_MAX {CVE-2024-46871}
  - ext4: avoid use-after-free in ext4_ext_show_leaf() {CVE-2024-49889}
  - wifi: ath11k: fix array out-of-bound access in SoC stats {CVE-2024-49930}
  - net: do not leave a dangling sk pointer, when socket creation fails {CVE-2024-40954}
  - net: sched: sch_multiq: fix possible OOB write in multiq_tune() {CVE-2024-36978}
  - drm/amdgpu: Validate TA binary size {CVE-2024-44977}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els10]
changelog:
  - smb: client: fix use-after-free of signing key {CVE-2024-53179}
  - smb: client: stop flooding dmesg in smb2_calc_signature() {CVE-2024-53179}
  - smb3: fix oops in calculating shash_setkey {CVE-2024-53179}
  - cifs: return correct error in ->calc_signature() {CVE-2024-53179}
  - cifs: secmech: use shash_desc directly, remove sdesc {CVE-2024-53179}
  - cifs: replace kfree() with kfree_sensitive() for sensitive data {CVE-2024-53179}
  - xsk: fix OOB map writes when deleting elements {CVE-2024-56614}
  - hv_sock: Initializing vsk->trans to NULL to prevent a dangling pointer {CVE-2024-53103}
  - scsi: sg: Fix slab-use-after-free read in sg_release() {CVE-2024-56631}
  - EDAC/igen6: Avoid segmentation fault on module unload {CVE-2024-56708}
  - acpi: nfit: vmalloc-out-of-bounds Read in acpi_nfit_ctl {CVE-2024-56662}
  - net: inet: do not leave a dangling sk pointer in inet_create() {CVE-2024-56601}
  - initramfs: avoid filename buffer overrun {CVE-2024-53142}
  - ALSA: usb-audio: Fix out of bounds reads when finding clock sources {CVE-2024-53150}
  - Bluetooth: RFCOMM: avoid leaving dangling sk pointer in rfcomm_sock_alloc() {CVE-2024-56604}
  - wifi: ath9k: add range check for conn_rsp_epid in htc_connect_service() {CVE-2024-53156}
  - Bluetooth: L2CAP: do not leave dangling sk pointer on error in l2cap_sock_create() {CVE-2024-56605}
  - Bluetooth: msft: fix slab-use-after-free in msft_do_close() {CVE-2024-36012}
  - Bluetooth: Fix support for Read Local Supported Codecs V2 {CVE-2024-36012}
  - Bluetooth: hci_codec: Fix leaking content of local_codecs {CVE-2024-36012}
  - blk-cgroup: Fix UAF in blkcg_unpin_online() {CVE-2024-56672}
  - net: ieee802154: do not leave a dangling sk pointer in ieee802154_create() {CVE-2024-56602}
  - net: inet6: do not leave a dangling sk pointer in inet6_create() {CVE-2024-56600}
  - NFSv4.0: Fix a use-after-free problem in the asynchronous open() {CVE-2024-53173}
  - net: af_can: do not leave a dangling sk pointer in can_create() {CVE-2024-56603}
  - drm/amd: Fix UBSAN array-index-out-of-bounds for SMU7 {CVE-2023-52818}
  - bpf, sockmap: Fix race between element replace and close() {CVE-2024-56664}
  - ceph: prevent use-after-free in encode_cap_msg() {CVE-2024-26689}
  - drm/amd/display: Fix out-of-bounds access in 'dcn21_link_encoder_create' {CVE-2024-56608}
  - netfilter: ipset: add missing range check in bitmap_ip_uadt {CVE-2024-53141}
  - HID: intel-ish-hid: ipc: Disable and reenable ACPI GPE bit {CVE-2023-52519}
  - tipc: Fix use-after-free of kernel socket in cleanup_bearer(). {CVE-2024-56642}
  - cifs: Fix buffer overflow when parsing NFS reparse points {CVE-2024-49996}
  - Input: powermate - fix use-after-free in powermate_config_complete {CVE-2023-52475}
  - PM / devfreq: Fix buffer overflow in trans_stat_show {CVE-2023-52614}
  - PM / devfreq: Rework freq_table to be local to devfreq struct {CVE-2023-52614}
  - cachefiles: fix slab-use-after-free in cachefiles_withdraw_cookie() {CVE-2024-41057}
  - cachefiles: fix slab-use-after-free in fscache_withdraw_volume() {CVE-2024-41058}
  - netfs, fscache: export fscache_put_volume() and add fscache_try_get_volume() {CVE-2024-41058}
  - memcg: fix possible use-after-free in memcg_write_event_control() {CVE-2022-48988}
  - Bluetooth: ISO: Fix UAF on iso_sock_timeout {CVE-2024-50124}
  - Bluetooth: SCO: Fix UAF on sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout {CVE-2024-50125}
  - Bluetooth: Consolidate code around sk_alloc into a helper function {CVE-2024-50125}
  - smb: client: fix potential UAF in cifs_signal_cifsd_for_reconnect() {CVE-2024-35861}
  - gtp: fix use-after-free and null-ptr-deref in gtp_genl_dump_pdp() {CVE-2024-26754}
  - smb: client: fix potential UAF in cifs_stats_proc_write() {CVE-2024-35868}
  - smb: client: fix potential UAF in cifs_debug_files_proc_show() {CVE-2024-35868}
  - vsock/virtio: Initialization of the dangling pointer occurring in vsk->trans {CVE-2024-50264}
  - net/sched: stop qdisc_tree_reduce_backlog on TC_H_ROOT {CVE-2024-53057}
  - wifi: iwlwifi: mvm: Fix a memory corruption issue {CVE-2023-52531}
  - x86/alternatives: Disable KASAN in apply_alternatives() {CVE-2023-52504}
  - bpf: Fix out-of-bounds write in trie_get_next_key() {CVE-2024-50262}
  - KVM: nSVM: Ignore nCR3[4:0] when loading PDPTEs from memory {CVE-2024-50115}
  - media: edia: dvbdev: fix a use-after-free {CVE-2024-27043}
  - media: dvb-core: Fix use-after-free due to race at dvb_register_device() {CVE-2024-27043}
  - media: dvbdev: fix build warning due to comments {CVE-2024-27043}
  - media: dvbdev: adopts refcnt to avoid UAF {CVE-2024-27043}


author: Vadim Panov <vadim.panov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els11]
changelog:
  - media: uvcvideo: Skip parsing frames of type UVC_VS_UNDEFINED in uvc_parse_format {CVE-2024-53104}
  - ALSA: 6fire: Release resources at card release {CVE-2024-53239}
  - bpf: Fix DEVMAP_HASH overflow check on 32-bit arches {CVE-2024-26885}
  - bpf: fix OOB devmap writes when deleting elements {CVE-2024-56615}
  - tcp/dccp: Don't use timer_pending() in reqsk_queue_unlink(). {CVE-2024-50154}
  - drm/amd/display: Fix a potential buffer overflow in 'dp_dsc_clock_en_read()' {CVE-2024-27045}
  - af_packet: avoid erroring out after sock_init_data() in packet_create() {CVE-2024-56606}
  - cifs: Fix use-after-free in rdata->read_into_pages() {CVE-2023-52741}
  - arm64: hibernate: Fix level3 translation fault in swsusp_save() {CVE-2024-26989}
  - perf: hisi: Fix use-after-free when register pmu fails {CVE-2023-52859}
  - nbd: fix uaf in nbd_open {CVE-2023-52837}
  - ring-buffer: Do not attempt to read past "commit" {CVE-2023-52501}
  - can: j1939: Fix UAF in j1939_sk_match_filter during setsockopt(SO_J1939_FILTER) {CVE-2023-52637}
  - Input: synaptics-rmi4 - fix use after free in rmi_unregister_function() {CVE-2023-52840}
  - asix: fix uninit-value in asix_mdio_read() {CVE-2021-47101}
  - pinctrl: core: delete incorrect free in pinctrl_enable() {CVE-2024-36940}
  - irqchip/gic-v3-its: Prevent double free on error {CVE-2024-35847}
  - net: openvswitch: Fix Use-After-Free in ovs_ct_exit {CVE-2024-27395}
  - mac802154: fix llsec key resources release in mac802154_llsec_key_del {CVE-2024-26961}
  - nfs: fix UAF in direct writes {CVE-2024-26958}
  - of: Fix double free in of_parse_phandle_with_args_map {CVE-2023-52679}
  - ext4: fix double-free of blocks due to wrong extents moved_len {CVE-2024-26704}
  - mlxsw: spectrum_acl_tcam: Fix possible use-after-free during activity update {CVE-2024-35855}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.11.1.el9_2.tuxcare.6.els12]
changelog:
  - spec: update shim Conflicts, Provides keys
  - HID: core: zero-initialize the report buffer {CVE-2024-50302}
  - net: defer final 'struct net' free in netns dismantle {CVE-2024-56658}
  - bus: mhi: host: Add alignment check for event ring read pointer {CVE-2023-52494}
  - net: sched: fix ets qdisc OOB Indexing {CVE-2025-21692}
  - parport: Proper fix for array out-of-bounds access {CVE-2024-50074}
  - udf: fix uninit-value use in udf_get_fileshortad {CVE-2024-50143}
  - security/keys: fix slab-out-of-bounds in key_task_permission {CVE-2024-50301}
  - usb: typec: altmode should keep reference to parent {CVE-2024-50150}
  - dm cache: fix potential out-of-bounds access on the first resume {CVE-2024-50278}
  - dm cache: optimize dirty bit checking with find_next_bit when resizing {CVE-2024-50278}
  - dm cache: fix out-of-bounds access to the dirty bitset when resizing {CVE-2024-50279}
  - spi: nxp-fspi: fix the KASAN report out-of-bounds bug {CVE-2024-46853}
  - smb: client: fix OOBs when building SMB2_IOCTL request {CVE-2024-50151}
  - net: sched: fix use-after-free in taprio_change() {CVE-2024-50127}
  - USB: serial: io_edgeport: fix use after free in debug printk {CVE-2024-50267}
  - wifi: iwlwifi: mvm: Fix response handling in iwl_mvm_send_recovery_cmd() {CVE-2024-53059}
  - wifi: iwlwifi: mvm: disconnect station vifs if recovery failed {CVE-2024-53059}
  - tracing: Consider the NULL character when validating the event length {CVE-2024-50131}
  - crypto: scomp - fix req->dst buffer overflow {CVE-2023-52612}
  - NFSD: fix hang in nfsd4_shutdown_callback {CVE-2025-21795}
  - NFSD: add courteous server support for thread with only delegation {CVE-2025-21795}
  - efi: rt-wrapper: Add missing include {CVE-2023-21102}
  - arm64: efi: Execute runtime services from a dedicated stack {CVE-2023-21102}
  - mptcp: refactor passive socket initialization {CVE-2024-26782}
  - mptcp: implement delayed seq generation for passive fastopen {CVE-2024-26782}
  - smb: client: fix potential UAF in smb2_is_valid_lease_break() {CVE-2024-35864}
  - smb: client: fix potential UAF in cifs_dump_full_key() {CVE-2024-35866}
  - cifs: fix session state check in reconnect to avoid use-after-free issue {CVE-2024-35866}
  - smb: client: fix potential UAF in smb2_is_network_name_deleted() {CVE-2024-35862}
  - smb: client: fix potential UAF in is_valid_oplock_break() {CVE-2024-35863}
  - smb: client: fix potential UAF in cifs_stats_proc_show() {CVE-2024-35867}
  - bpf: Protect against int overflow for stack access size {CVE-2024-35905}
  - bpf: Fix verification of indirect var-off stack access {CVE-2024-35905}
  - devlink: fix possible use-after-free and memory leaks in devlink_init() {CVE-2024-26734}
  - leds: trigger: Unregister sysfs attributes before calling deactivate() {CVE-2024-43830}
  - ionic: fix use after netif_napi_del() {CVE-2024-39502}
  - ionic: clean interrupt before enabling queue to avoid credit race {CVE-2024-39502}
  - net/mlx5e: SHAMPO, Fix invalid WQ linked list unlink {CVE-2024-44970}
  - vt_ioctl: fix array_index_nospec in vt_setactivate {CVE-2022-48804}
  - hwmon: (coretemp) fix pci device refcount leak in nv1a_ram_new() {CVE-2022-49011}
  - raid1: fix use-after-free for original bio in raid1_write_request() {CVE-2024-35979}
  - md/raid1: free the r1bio before waiting for blocked rdev {CVE-2024-35979}
  - drm/amdgpu: fix usage slab after free {CVE-2024-56551}
  - drm/amd: Use `amdgpu_ucode_*` helpers for GPU info bin {CVE-2024-56551}
  - drm/amd: Add a new helper for loading/validating microcode {CVE-2024-56551}
  - drm/amd: check num of link levels when update pcie param {CVE-2023-52812}
  - drm/amd: Update `update_pcie_parameters` functions to use uint8_t arguments {CVE-2023-52812}
  - drm/amd: Disable PP_PCIE_DPM_MASK when dynamic speed switching not supported {CVE-2023-52812}
  - drm/amd: Fix logic error in sienna_cichlid_update_pcie_parameters() {CVE-2023-52812}
  - drm/amd: Use amdgpu_device_pcie_dynamic_switching_supported() for SMU7 {CVE-2023-52812}
  - drm/amd: Align SMU11 SMU_MSG_OverridePcieParameters implementation with SMU13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane switching for some sienna_cichlid SKUs {CVE-2023-52812}
  - drm/amd: Move helper for dynamic speed switch check out of smu13 {CVE-2023-52812}
  - drm/amd/pm: conditionally disable pcie lane/speed switching for SMU13 {CVE-2023-52812}
  - drm/amd/pm: share the code around SMU13 pcie parameters update {CVE-2023-52812}
  - drm: zynqmp_kms: Unplug DRM device before removal {CVE-2024-56538}
  - padata: Fix refcnt handling in padata_free_shell() {CVE-2023-52854}
  - padata: Convert from atomic_t to refcount_t on parallel_data->refcnt {CVE-2023-52854}
  - drm/dp_mst: Ensure mst_primary pointer is valid in drm_dp_mst_handle_up_req() {CVE-2024-57798}
  - drm/dp_mst: Skip CSN if topology probing is not done yet {CVE-2024-57798}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els13]
changelog:
  - ext4: fix OOB read when checking dotdot dir {CVE-2025-37785}
  - wifi: iwlwifi: limit printed string from FW file {CVE-2025-21905}
  - drm/amdgpu: Fix potential out-of-bounds access in 'amdgpu_discovery_reg_base_init()' {CVE-2024-27042}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - sunrpc: fix one UAF issue caused by sunrpc kernel tcp socket {CVE-2024-53168}
  - cifs: Fix UAF in cifs_demultiplex_thread() {CVE-2023-52572}
  - veth: Fix use after free in XDP_REDIRECT {CVE-2023-53107}
  - firmware: arm_scmi: Fix slab-use-after-free in scmi_bus_notifier() {CVE-2024-53068}
  - arm64/sve: Discard stale CPU state when handling SVE traps {CVE-2024-50275}
  - Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd {CVE-2025-21969}
  - wifi: mt76: mt7921e: fix use-after-free in free_irq() {CVE-2024-26892}
  - rtc: pcf85063: fix potential OOB write in PCF85063 NVMEM read {CVE-2024-58069}
  - nvme-tcp: fix potential memory corruption in nvme_tcp_recv_pdu() {CVE-2025-21927}
  - pfifo_tail_enqueue: Drop new packet when sch->limit == 0 {CVE-2025-21702}
  - net_sched: sch_fifo: implement lockless __fifo_dump() {CVE-2025-21702}
  - iscsi_ibft: Fix UBSAN shift-out-of-bounds warning in ibft_attr_show_nic() {CVE-2025-21993}
  - vlan: enforce underlying device type {CVE-2025-21920}
  - HID: intel-ish-hid: Fix use-after-free issue in ishtp_hid_remove() {CVE-2025-21928}
  - watch_queue: Actually free the watch {CVE-2022-49256}
  - can: bcm: Fix UAF in bcm_proc_show() {CVE-2023-52922}
  - ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() {CVE-2023-52988}
  - netfilter: nf_set_pipapo: fix initial map fill {CVE-2024-57947}
  - hwmon: (lm90) Prevent integer overflow/underflow in hysteresis calculations {CVE-2021-47098}
  - aio: fix use-after-free due to missing POLLFREE handling {CVE-2021-47505}
  - aio: keep poll requests on waitqueue until completed {CVE-2021-47505}
  - smb: client: fix potential deadlock when releasing mids {CVE-2023-52757}
  - cifs: remove useless DeleteMidQEntry() {CVE-2023-52757}
  - media: uvcvideo: Remove dangling pointers {CVE-2024-58002}
  - media: uvcvideo: Only save async fh if success {CVE-2024-58002}
  - media: uvcvideo: Refactor iterators {CVE-2024-58002}
  - drm: nv04: Fix out of bounds access {CVE-2024-27008}
  - drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() {CVE-2025-21780}
  - arm64: cacheinfo: Avoid out-of-bounds write to cacheinfo array {CVE-2025-21785}
  - net: rose: fix timer races against user threads {CVE-2025-21718}
  - media: uvcvideo: Fix double free in error path {CVE-2024-57980}
  - vrf: use RCU protection in l3mdev_l3_out() {CVE-2025-21791}
  - geneve: Fix use-after-free in geneve_find_dev(). {CVE-2025-21858}
  - afs: Increase buffer size in afs_update_volume_status() {CVE-2024-26736}
  - net: atlantic: eliminate double free in error handling logic {CVE-2023-52664}
  - bpf: Check validity of link->type in bpf_link_show_fdinfo() {CVE-2024-53099}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els14]
changelog:
  - rcu-tasks: Fix show_rcu_tasks_trace_gp_kthread buffer overflow {CVE-2024-38577}
  - tcp: fix mptcp DSS corruption due to large pmtu xmit {CVE-2024-50083}
  - vsock: Keep the binding until socket destruction {CVE-2025-21756}
  - memstick: rtsx_usb_ms: Fix slab-use-after-free in rtsx_usb_ms_drv_remove {CVE-2025-22020}
  - drm/i915: Fix potential bit_17 double-free {CVE-2023-52930}
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition {CVE-2025-22056}
  - mm: shmem: fix data-race in shmem_getattr() {CVE-2024-46828}
  - nvmet-auth: assign dh_key to NULL after kfree_sensitive {CVE-2024-50215}
  - net: explicitly clear the sk pointer, when pf->create fails {CVE-2024-50186}
  - net: wwan: fix global oob in wwan_rtnl_policy {CVE-2024-50128}
  - ext4: drop ppath from ext4_ext_replay_update_ex() to avoid double-free {CVE-2024-49983}
  - vhost_vdpa: assign irq bypass producer token correctly {CVE-2024-47748}
  - wifi: rtw88: always wait for both firmware loading attempts {CVE-2024-47718}
  - sched: sch_cake: fix bulk flow accounting logic for host fairness {CVE-2024-46828}
  - fscache: delete fscache_cookie_lru_timer when fscache exits to avoid UAF {CVE-2024-46786}
  - net: bridge: mcast: wait for previous gc cycles when removing port {CVE-2024-44934}
  - vhost/vsock: always initialize seqpacket_allow {CVE-2024-43873}
  - ext4: check dot and dotdot of dx_root before making dir indexed {CVE-2024-42305}
  - nfsd: make sure exp active before svc_export_show {CVE-2024-56558}
  - SUNRPC: make sure cache entry active before cache_show {CVE-2024-53174}
  - Bluetooth: MGMT: Fix slab-use-after-free Read in set_powered_sync {CVE-2024-53208}
  - wifi: nl80211: fix NL80211_ATTR_MLO_LINK_ID off-by-one {CVE-2024-56663}
  - Bluetooth: fix use-after-free in device_for_each_child() {CVE-2024-53237}
  - hwmon: (ibmpex) Fix possible UAF when ibmpex_register_bmc() fails {CVE-2022-49029}
  - tracing: Free buffers when a used dynamic event is removed {CVE-2022-49006}
  - net: tun: Fix use-after-free in tun_detach() {CVE-2022-49014}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els15]
changelog:
  - udmabuf: fix a buf size overflow issue during udmabuf creation {CVE-2025-37803}
  - bpf: Prevent tail call between progs attached to different hooks {CVE-2024-50063}
  - nfsd: fix possible badness in FREE_STATEID {CVE-2024-50043}
  - nfsd: prevent panic for nfsv4.0 closed files in nfs4_show_open {CVE-2024-46682}
  - nfsd: fix race between laundromat and free_stateid {CVE-2024-50106}
  - nfsd: split sc_status out of sc_type {CVE-2024-46682}
  - net: gso: fix ownership in __udp_gso_segment {CVE-2025-21926}
  - net: fix geneve_opt length integer overflow {CVE-2025-22055}
  - net: usb: lan78xx: Fix double free issue with interrupt buffer allocation {CVE-2024-53213}
  - mm/khugepaged: invoke MMU notifiers in shmem/file collapse paths {CVE-2022-48991}
  - xfrm: state: fix out-of-bounds read during lookup {CVE-2024-57982}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els16]
changelog:
  - udf: Fix a slab-out-of-bounds write bug in udf_find_entry() {CVE-2022-49846}
  - net: atm: fix use after free in lec_send() {CVE-2025-22004}
  - ovl: fix UAF in ovl_dentry_update_reval by moving dput() in ovl_link_up {CVE-2025-21887}
  - rcutorture: Fix ksoftirqd boosting timing and iteration {CVE-2022-50177}
  - tty: n_gsm: add sanity check for gsm->receive in gsm_receive_buf() {CVE-2022-49940}
  - selinux: Add boundary check in put_entry() {CVE-2022-50200}
  - Squashfs: fix handling and sanity checking of xattr_ids count {CVE-2023-52933}
  - net: atlantic: fix aq_vec index out of range error {CVE-2022-50066}
  - ext4: ignore xattrs past end {CVE-2025-37738}
  - ext4: fix off-by-one error in do_split {CVE-2025-23150}
  - sched/fair: Fix potential memory corruption in child_cfs_rq_on_list {CVE-2025-21919}
  - md: fix mddev uaf while iterating all_mddevs list {CVE-2025-22126}
  - ndisc: use RCU protection in ndisc_alloc_skb() {CVE-2025-21764}
  - md: factor out a helper from mddev_put()
  - Fix "Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd"
  - ext4: prevent stale extent cache entries caused by concurrent get es_cache


author: Vadim Panov <vadim.panov@yahoo.com> [5.14.0-284.1101.el9_2.tuxcare.7.els17]
changelog:
  - net_sched: hfsc: Fix a UAF vulnerability in class handling {CVE-2025-37797}
  - sunrpc: handle SVC_GARBAGE during svc auth processing as auth error {CVE-2025-38089}
  - net: ch9200: fix uninitialised access during mii_nway_restart {CVE-2025-38086}
  - ext4: fix out-of-bound read in ext4_xattr_inode_dec_ref_all() {CVE-2025-22121}
  - locking/csd_lock: Change csdlock_debug from early_param to __setup {CVE-2022-50091}
  - x86/microcode/AMD: Fix out-of-bounds on systems with CPU-less NUMA nodes {CVE-2025-21991}
  - ftrace: Fix NULL pointer dereference in is_ftrace_trampoline when ftrace is dead {CVE-2022-49977}
  - NFSv4/pnfs: Fix a use-after-free bug in open {CVE-2022-50072}
  - NFSv4: Don't hold the layoutget locks across multiple RPC calls {CVE-2022-49316}
  - mm/khugepaged: fix ->anon_vma race {CVE-2023-52935}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els18]
changelog:
  - tls: always refresh the queue when reading sock {CVE-2025-38471}
  - Bluetooth: hci_core: Fix use-after-free in vhci_flush() {CVE-2025-38250}
  - i2c/designware: Fix an initialization issue {CVE-2025-38380}
  - wifi: rtw88: fix the 'para' buffer size to avoid reading out of bounds {CVE-2025-38159}
  - mm/hugetlb: fix huge_pmd_unshare() vs GUP-fast race {CVE-2025-38085}
  - mm/khugepaged: fix GUP-fast interaction by sending IPI
  - bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() {CVE-2025-21867}
  - crypto: algif_hash - fix double free in hash_accept {CVE-2025-38079}
  - ext4: avoid journaling sb update on error if journal is destroying {CVE-2025-22113}
  - ext4: define ext4_journal_destroy wrapper
  - Bluetooth: L2CAP: Fix slab-use-after-free in l2cap_connect() {CVE-2024-36013}
  - Bluetooth: Remove BT_HS {CVE-2024-38620}
  - block, bfq: fix bfqq uaf in bfq_limit_depth() {CVE-2024-53166}
  - dm-crypt: don't modify the data when using authenticated encryption {CVE-2024-26763}
  - bpf: Fix helper writes to read-only maps (alt version) {CVE-2024-49861}
  - bpf: Check rcu_read_lock_trace_held() before calling bpf map helpers {CVE-2023-52621}
  - netfilter: xtables: avoid NFPROTO_UNSPEC where needed {CVE-2024-50038}
  - xfs: add bounds checking to xlog_recover_process_data {CVE-2024-41014}
  - scsi: mpt3sas: Avoid test/set_bit() operating in non-allocated memory {CVE-2024-40901}
  - net/mlx5: Add a timeout to acquire the command queue semaphore {CVE-2024-38556}
  - net: tipc: fix refcount warning in tipc_aead_encrypt {CVE-2025-38273}
  - net_sched: hfsc: Fix a UAF vulnerability in class with netem as child qdisc {CVE-2025-37890}
  - net/tipc: fix slab-use-after-free Read in tipc_aead_encrypt_done {CVE-2025-38052}
  - misc/vmw_vmci: fix an infoleak in vmci_host_do_receive_datagram() {CVE-2022-49788}
  - padata: fix UAF in padata_reorder {CVE-2025-21727}
  - RDMA/mlx5: Fix page_size variable overflow {CVE-2025-22091}


author: Vadim Panov <vpanov@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els19]
changelog:
  - mm/hugetlb: unshare page tables during VMA split, not before {CVE-2025-38084}
  - hugetlb: unshare some PMDs when splitting VMAs {CVE-2025-38084}
  - posix-cpu-timers: fix race between handle_posix_cpu_timers() and posix_cpu_timer_del() {CVE-2025-38352}
  - tipc: Fix use-after-free in tipc_conn_close(). {CVE-2025-38464}
  - vsock: Fix transport_* TOCTOU {CVE-2025-38461}
  - RDMA/iwcm: Fix use-after-free of work objects after cm_id destruction {CVE-2025-38211}
  - i40e: fix MMIO write access to an invalid page in i40e_clear_hw {CVE-2025-38200}
  - net_sched: ets: Fix double list add in class with netem as child qdisc {CVE-2025-37914}
  - net_sched: hfsc: Fix a potential UAF in hfsc_dequeue() too {CVE-2025-37823}
  - udp: Fix memory accounting leak. {CVE-2025-22058}
  - net/sched: Always pass notifications when child class becomes empty {CVE-2025-38350}
  - codel: remove sch->q.qlen check before qdisc_tree_reduce_backlog() {CVE-2025-38177}
  - sch_htb: make htb_deactivate() idempotent {CVE-2025-38177}
  - sch_drr: make drr_qlen_notify() idempotent {CVE-2025-38177}
  - sch_htb: make htb_qlen_notify() idempotent {CVE-2025-38177}
  - sch_qfq: make qfq_qlen_notify() idempotent {CVE-2025-38177}
  - sch_ets: make est_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: make hfsc_qlen_notify() idempotent {CVE-2025-38177}
  - sch_hfsc: Fix qlen accounting bug when using peek in hfsc_enqueue() {CVE-2025-38000}
  - net: fix udp gso skb_segment after pull from frag_list {CVE-2025-38124}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els20]
changelog:
  - drm/amd/amdgpu: introduce gc_*_mes_2.bin v2
  - proc: fix a dentry lock race between release_task and lookup
  - scsi: aacraid: Stop using PCI_IRQ_AFFINITY
  - scsi: aacraid: Remove useless code
  - scsi: aacraid: Remove unused aac_check_health()
  - scsi: aacraid: struct {user,}sgmap{,64,raw}: Replace 1-element arrays with flexible arrays
  - scsi: aacraid: Rearrange order of struct aac_srb_unit
  - scsi: aacraid: struct aac_ciss_phys_luns_resp: Replace 1-element array with flexible array
  - scsi: aacraid: union aac_init: Replace 1-element array with flexible array
  - scsi: aacraid: aachba: Replace snprintf() with the safer scnprintf() variant
  - Revert "scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity"
  - scsi: aacraid: Avoid -Warray-bounds warning
  - scsi: aacraid: Reply queue mapping to CPUs based on IRQ affinity
  - scsi: aacraid: Replace all non-returning strlcpy with strscpy
  - scsi: aacraid: Declare SCSI host template const
  - scsi: aacraid: Drop redundant pci_enable_pcie_error_reporting()
  - scsi: aacraid: Allocate cmd_priv with scsicmd
  - scsi: aacraid: Remove redundant "the"
  - scsi: aacraid: Fix undefined behavior due to shift overflowing the constant
  - scsi: aacraid: Clean up some inconsistent indenting
  - scsi: aacraid: Move the SCSI pointer to private command data
  - scsi: aacraid: Fix spelling of "its"
  - scsi: aacraid: Call scsi_done() directly
  - scsi: aacraid: Introduce aac_scsi_done()
  - scsi: aacraid: Use scsi_cmd_to_rq() instead of scsi_cmnd.request
  - scsi: aacraid: Remove an unused include
  - x86/sev: Check for MWAITX and MONITORX opcodes in the #VC handler {CVE-2024-25743}
  - net: sched: sfb: fix null pointer access issue when sfb_init() fails {CVE-2022-50356}
  - ipv6: mcast: Delay put pmc->idev in mld_del_delrec() {CVE-2025-38550}
  - scsi: lpfc: Use memcpy() for BIOS version {CVE-2025-38332}
  - PM: hibernate: defer device probing when resuming from hibernation {CVE-2022-50202}
  - net: fix UaF in netns ops registration error path {CVE-2023-52999}
  - net: fix UAF issue in nfqnl_nf_hook_drop() when ops_init() failed {CVE-2023-52999}
  - usb: typec: fix potential array underflow in ucsi_ccg_sync_control() {CVE-2024-53203}
  - soundwire: cadence: fix invalid PDI offset {CVE-2024-38635}
  - drm/i915/vma: Fix UAF on destroy against retire race {CVE-2024-26939}
  - netns: Make get_net_ns() handle zero refcount net {CVE-2024-40958}
  - bonding: Fix out-of-bounds read in bond_option_arp_ip_targets_set() {CVE-2024-39487}
  - wifi: iwlwifi: mvm: guard against invalid STA ID on removal {CVE-2024-36921}
  - wifi: ath11k: fix gtk offload status event locking {CVE-2023-52777}
  - wifi: mac80211: fix potential key use-after-free {CVE-2023-52530}
  - i2c: mlxbf: prevent stack overflow in mlxbf_i2c_smbus_start_transaction() {CVE-2022-48632}
  - net/sched: act_mirred: don't override retval if we already lost the skb {CVE-2024-26739}
  - can: j1939: j1939_netdev_start(): fix UAF for rx_kref of j1939_priv {CVE-2021-47459}
  - net: hns3: fix use-after-free bug in hclgevf_send_mbx_msg {CVE-2021-47596}
  - Squashfs: check the inode number is not the invalid value of zero {CVE-2024-26982}
  - crypto: qat - resolve race condition during AER recovery {CVE-2024-26974}
  - crypto: qat - fix double free during reset
  - media: pvrusb2: fix use after free on context disconnection {CVE-2023-52445}
  - fs/smb/client: Reset password pointer to NULL {CVE-2023-5345}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els21]
changelog:
  - mm: zswap: fix missing folio cleanup in writeback race path {CVE-2024-26832}
  - mm: fix zswap writeback race condition {CVE-2023-53178}
  - dm array: fix releasing a faulty array block twice in dm_array_cursor_end {CVE-2024-57929}
  - drm/dp_mst: Fix MST sideband message body length check {CVE-2024-56616}
  - gpio: davinci: Validate the obtained number of IRQs {CVE-2024-42092}
  - ASoC: topology: Fix references to freed memory {CVE-2024-41069}
  - Bluetooth: hci_sock: Fix not validating setsockopt user input {CVE-2024-35963}
  - Bluetooth: ISO: Fix not validating setsockopt user input {CVE-2024-35964}
  - Bluetooth: L2CAP: Fix not validating setsockopt user input {CVE-2024-35965}
  - Bluetooth: RFCOMM: Fix not validating setsockopt user input {CVE-2024-35966}
  - Bluetooth: SCO: Fix not validating setsockopt user input {CVE-2024-35967}
  - dma-direct: Leak pages on dma_set_decrypted() failure {CVE-2024-35939}
  - wifi: mwifiex: avoid possible NULL skb pointer dereference {CVE-2023-53384}
  - md/raid10: fix null-ptr-deref of mreplace in raid10_sync_request {CVE-2023-53380}
  - icmp6: Fix null-ptr-deref of ip6_null_entry->rt6i_idev in icmp6_dev(). {CVE-2023-53343}
  - thermal: core: prevent potential string overflow {CVE-2023-52868}
  - drm/amdkfd: Fix shift out-of-bounds issue {CVE-2023-52816}
  - drm/vkms: Fix null-ptr-deref in vkms_release() {CVE-2022-50369}
  - nvmem: Fix shift-out-of-bound (UBSAN) with byte size cells {CVE-2021-47497}
  - net/mlx5: Fix tainted pointer delete is case of flow rules creation fail {CVE-2024-40940}
  - ipvlan: add ipvlan_route_v6_outbound() helper {CVE-2023-52796}
  - platform/x86: wmi: Fix opening of char device {CVE-2023-52864}
  - platform/x86: wmi: remove unnecessary initializations
  - perf/core: Bail out early if the request AUX area is out of bound {CVE-2023-52835}
  - do_change_type(): refuse to operate on unmounted/not ours mounts {CVE-2025-38498}
  - net_sched: hfsc: Address reentrant enqueue adding class to eltree twice {CVE-2025-38001}
  - usb: cdc-acm: Check control transfer buffer size before access {CVE-2025-21704}
  - vfio/pci: Properly hide first-in-list PCIe extended capability {CVE-2024-53214}
  - igb: Fix potential invalid memory access in igb_init_module() {CVE-2024-52332}
  - kobject_uevent: Fix OOB access within zap_modalias_env() {CVE-2024-42292}
  - mm: kmem: fix a NULL pointer dereference in obj_stock_flush_required() {CVE-2023-53401}
  - net: usb: smsc75xx: Limit packet length to skb->len {CVE-2023-53125}
  - drm/radeon: possible buffer overflow {CVE-2023-52867}
  - media: gspca: cpia1: shift-out-of-bounds in set_flicker {CVE-2023-52764}
  - wifi: mac80211_hwsim: Fix possible NULL dereference {CVE-2023-53209}
  - vmci: prevent speculation leaks by sanitizing event in event_deliver() {CVE-2024-39499}
  - wifi: iwlwifi: fw: fix memory leak in debugfs {CVE-2023-53422}
  - drm/amdgpu: fix memory leak in mes self test {CVE-2023-53370}
  - skbuff: skb_segment, Call zero copy functions before using skbuff frags {CVE-2023-53354}
  - md/raid10: fix leak of 'r10bio->remaining' for recovery {CVE-2023-53299}
  - nfsd: call op_release, even when op_func returns an error {CVE-2023-53241}
  - ppdev: Add an error check in register_device {CVE-2024-36015}
  - wifi: cfg80211: check A-MSDU format more carefully {CVE-2024-35937}
  - net: bridge: use DEV_STATS_INC() {CVE-2023-52578}
  - net: add atomic_long_t to net_device_stats fields {CVE-2024-26882}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els22]
changelog:
  - locking/ww_mutex/test: Fix potential workqueue corruption {CVE-2023-52836}
  - netfilter: ipset: Fix suspicious rcu_dereference_protected() {CVE-2024-40993}
  - netfilter: ipset: Fix race between namespace cleanup and gc in the list:set type {CVE-2024-39503}
  - netfilter: ipset: Missing gc cancellations fixed {CVE-2024-39503}
  - netfilter: ipset: Add list flush to cancel_gc {CVE-2024-39503}
  - netfilter: ipset: fix performance regression in swap operation {CVE-2024-26910}
  - netfilter: ipset: fix race condition between swap/destroy and kernel side add/del/test {CVE-2024-26910}
  - scsi: ses: Fix slab-out-of-bounds in ses_intf_remove() {CVE-2023-53521}
  - scsi: mpt3sas: Fix a memory leak {CVE-2023-53512}
  - scsi: iscsi_tcp: Check that sock is valid before iscsi_set_param() {CVE-2023-53464}
  - wifi: ath11k: fix deinitialization of firmware resources {CVE-2023-53532}
  - mt76: mt7915: Fix PCI device refcount leak in mt7915_pci_init_hif2() {CVE-2022-50464}
  - ionic: catch failure from devlink_alloc {CVE-2023-53470}
  - enic: Validate length of nl attributes in enic_set_vf_port {CVE-2024-38659}
  - gpiolib: cdev: fix uninitialised kfifo {CVE-2024-36898}
  - Bluetooth: hci_conn: Fix crash on hci_create_cis_sync {CVE-2022-50447}
  - net/sched: taprio: always validate TCA_TAPRIO_ATTR_PRIOMAP {CVE-2024-36974}
  - ext4: Fix function prototype mismatch for ext4_feat_ktype {CVE-2023-53224}
  - ipv6: Add lwtunnel encap size of all siblings in nexthop calculation {CVE-2023-53477}
  - netfilter: nf_tables: prefer nft_chain_validate {CVE-2024-41042}
  - netfilter: nf_conntrack: fix crash due to removal of uninitialised entry {CVE-2025-38472}
  - Bluetooth: qca: add missing firmware sanity checks {CVE-2024-36880}
  - Bluetooth: qca: fix info leak when fetching fw build id {CVE-2024-36032}
  - Bluetooth: L2CAP: fix "bad unlock balance" in l2cap_disconnect_rsp {CVE-2023-53297}
  - drm/amd/display: Skip finding free audio for unknown engine_id {CVE-2024-42119}
  - drm/dp_mst: Fix resetting msg rx state after topology removal {CVE-2024-57876}
  - drm/vc4: don't check if plane->state->fb == state->fb {CVE-2024-35932}
  - drm/nouveau/disp: fix use-after-free in error handling of nouveau_connector_create {CVE-2023-53263}
  - cifs: fix oops during encryption {CVE-2022-50341}
  - smb: client: fix use-after-free in cifs_oplock_break {CVE-2025-38527}
  - smb: client: fix race with concurrent opens in rename(2) {CVE-2025-39825}
  - ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL {CVE-2023-52697}
  - blk-mq: fix NULL dereference on q->elevator in blk_mq_elv_switch_none {CVE-2023-53292}
  - mlx5: fix possible ptp queue fifo use-after-free {CVE-2023-53398}
  - sctp: check send stream number after wait_for_sndbuf {CVE-2023-53296}
  - sctp: linearize cloned gso packets in sctp_rcv {CVE-2025-38718}
  - ip6mr: Fix skb_under_panic in ip6mr_cache_report() {CVE-2023-53365}
  - scsi: mpi3mr: Use number of bits to manage bitmap sizes {CVE-2023-53376}
  - scsi: qla2xxx: Remove unused nvme_ls_waitq wait queue {CVE-2023-53280}
  - mt76: mt7921: fix kernel panic by accessing unallocated eeprom.data {CVE-2023-53232}
  - wifi: ath9k: don't allow to overwrite ENDPOINT0 attributes {CVE-2023-53185}
  - fbdev: Fix invalid page access after closing deferred I/O devices {CVE-2023-52731}
  - ACPICA: Add AML_NO_OPERAND_RESOLVE flag to Timer {CVE-2023-53395}
  - ACPI: processor: idle: Check acpi_fetch_acpi_dev() return value {CVE-2022-50327}
  - media: az6007: Fix null-ptr-deref in az6007_i2c_xfer() {CVE-2023-53220}
  - media: dvb-usb: az6027: fix null-ptr-deref in az6027_i2c_xfer() {CVE-2022-50272}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els23]
changelog:
  - nfs: fix possible null-ptr-deref when parsing param {CVE-2022-50455}
  - KVM: arm64: Disassociate vcpus from redistributor region on teardown {CVE-2024-40989}
  - HID: core: Harden s32ton() against conversion to 0 bits {CVE-2025-38556}
  - ALSA: usb-audio: Validate UAC3 cluster segment descriptors {CVE-2025-39757}
  - tcp_bpf: Fix the sk_mem_uncharge logic in tcp_bpf_sendmsg {CVE-2024-56633}
  - ovl: Filter invalid inodes with missing lookup function {CVE-2024-56570}
  - ACPI: processor: Check for null return of devm_kzalloc() in fch_misc_setup() {CVE-2023-53483}
  - crypto: seqiv - Handle EBUSY correctly {CVE-2023-53373}
  - KVM: nSVM: Check instead of asserting on nested TSC scaling support {CVE-2023-53663}
  - ice: Don't tx before switchdev is fully configured {CVE-2023-53657}
  - rcu: Avoid stack overflow due to __rcu_irq_enter_check_tick() being kprobe-ed {CVE-2023-53655}
  - mm/swap: fix swap_info_struct race between swapoff and get_swap_pages() {CVE-2023-53623}
  - ext4: fix bug_on in __es_tree_search caused by bad boot loader inode {CVE-2022-50485}
  - ext4: add EXT4_IGET_BAD flag to prevent unexpected bad inode {CVE-2022-50485}
  - ext4: add helper to check quota inums {CVE-2022-50485}
  - ext4: fix bug_on in __es_tree_search caused by bad quota inode {CVE-2022-50485}
  - swiotlb: Fix double-allocation of slots due to broken alignment handling {CVE-2024-35814}
  - swiotlb: fix a braino in the alignment check fix {CVE-2024-35814}
  - swiotlb: fix slot alignment checks {CVE-2024-35814}
  - swiotlb: fix the deadlock in swiotlb_do_find_slots
  - drm/radeon: free iio for atombios when driver shutdown {CVE-2023-53453}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els24]
changelog:
  - perf/aux: Fix AUX buffer serialization {CVE-2024-46713}
  - block: fix uaf for flush rq while iterating tags {CVE-2024-53170}
  - zram: fix potential UAF of zram table {CVE-2025-21671}
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts {CVE-2025-21647}
  - bpf: Fix UAF via mismatching bpf_prog/attachment RCU flavors {CVE-2024-56675}
  - net: openvswitch: fix nested key length validation in the set() action {CVE-2025-37789}
  - isofs: Prevent the use of too small fid {CVE-2025-37780}
  - net: ppp: Add bound checking for skb data on ppp_sync_txmung {CVE-2025-37749}
  - sctp: detect and prevent references to a freed transport in sendmsg {CVE-2025-23142}
  - ipv6: sr: Fix MAC comparison to be constant-time {CVE-2025-39702}
  - RDMA/rxe: Fix incomplete state save in rxe_requester {CVE-2023-53539}
  - crypto: xts - Handle EBUSY correctly {CVE-2023-53494}
  - Bluetooth: use RCU for hci_conn_params and iterate safely in hci_sync {CVE-2023-53252}
  - af_unix: Fix data-races around user->unix_inflight. {CVE-2023-53204}
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy {CVE-2022-50367}
  - wifi: rtlwifi: remove unused check_buddy_priv {CVE-2024-58072}
  - wifi: rtlwifi: remove unused dualmac control leftovers
  - wifi: rtlwifi: remove unused timer and related code
  - partitions: mac: fix handling of bogus partition table {CVE-2025-21772}
  - ipmr: do not call mr_mfc_uses_dev() for unres entries {CVE-2025-21719}
  - wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() {CVE-2024-58014}
  - net: mdio: validate parameter addr in mdiobus_get_phy() {CVE-2023-53019}
  - ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control {CVE-2025-39751}
  - NFS: Fix filehandle bounds checking in nfs_fh_to_dentry() {CVE-2025-39730}
  - net/mlx5e: Check for NOT_READY flag state after locking {CVE-2023-53581}
  - null_blk: Always check queue mode setting from configfs {CVE-2023-53576}
  - ip_vti: fix potential slab-use-after-free in decode_session6 {CVE-2023-53559}
  - rcu-tasks: Avoid pr_info() with spin lock in cblist_init_generic() {CVE-2023-53558}
  - pstore/ram: Check start of empty przs during init {CVE-2023-53331}
  - wifi: ath11k: fix memory leak in WMI firmware stats {CVE-2023-53602}
  - wifi: mac80211: fix invalid drv_sta_pre_rcu_remove calls for non-uploaded sta {CVE-2023-53229}
  - net: ethernet: ti: Fix return type of netcp_ndo_start_xmit() {CVE-2022-50486}
  - RDMA/core: Make sure "ib_port" is valid when access sysfs node {CVE-2022-50475}
  - RDMA/rxe: Fix mr->map double free {CVE-2022-50543}
  - scsi: qla2xxx: Fix end of loop test
  - scsi: qla2xxx: Fix mem access after free
  - scsi: qla2xxx: Wait for io return on terminate rport {CVE-2023-53322}
  - scsi: target: Fix multiple LUN_RESET handling {CVE-2023-53586}
  - scsi: ses: Fix possible desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix possible addl_desc_ptr out-of-bounds accesses {CVE-2023-53675}
  - scsi: ses: Fix slab-out-of-bounds in ses_enclosure_data_process() {CVE-2023-53675}
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path {CVE-2025-39841}
  - nbd: fix incomplete validation of ioctl arg {CVE-2023-53513}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare {CVE-2025-39817}
  - bnxt: avoid overflow in bnxt_get_nvram_directory() {CVE-2023-53661}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els25]
changelog:
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock {CVE-2025-38117}
  - padata: Fix pd UAF once and for all {CVE-2025-38584}
  - wifi: cfg80211: Fix use after free for wext {CVE-2023-53153}
  - padata: Fix list iterator in padata_do_serial()
  - padata: do not leak refcount in reorder_work {CVE-2025-38031}
  - padata: avoid UAF for reorder_work {CVE-2025-21726}
  - padata: add pd get/put refcnt helper
  - net/smc: fix UAF on smcsk after smc_listen_out() {CVE-2025-38734}
  - scsi: mpi3mr: Bad drive in topology results kernel crash {CVE-2023-53037}
  - scsi: mpi3mr: Driver unload crashes host when enhanced logging is enabled
  - wifi: brcmfmac: Fix potential stack-out-of-bounds in brcmf_c_preinit_dcmds() {CVE-2022-50258}
  - igb: Fix igb_down hung on surprise removal {CVE-2023-53148}
  - drm/i915/sseu: fix max_subslices array-index-out-of-bounds access {CVE-2023-53112}
  - i40e: fix idx validation in config queues msg {CVE-2025-39971}
  - dm-bufio: don't schedule in atomic context {CVE-2025-37928}
  - fs: prevent out-of-bounds array speculation when closing a file descriptor {CVE-2023-53117}
  - vhost-scsi: Fix handling of multiple calls to vhost_scsi_set_endpoint {CVE-2025-22083}
  - iommu/amd: Fix potential buffer overflow in parse_ivrs_acpihid {CVE-2025-37927}
  - tracing: Fix oob write in trace_seq_to_buffer() {CVE-2025-37923}
  - KVM: x86: Reset IRTE to host control if *new* route isn't postable {CVE-2025-37885}
  - KVM: arm64: Tear down vGIC on failed vCPU creation {CVE-2025-37849}
  - KVM: Reject attempts to consume or refresh inactive gfn_to_pfn_cache {CVE-2022-49882}
  - jbd2: remove wrong sb->s_sequence check {CVE-2025-37839}
  - power: supply: gpio-charger: Fix set charge current limits {CVE-2024-57792}
  - ASoC: dapm: Fix UAF for snd_soc_pcm_runtime object {CVE-2024-46798}
  - ipv6: prevent possible UAF in ip6_xmit() {CVE-2024-44985}
  - ipv6: fix possible UAF in ip6_finish_output2() {CVE-2024-44986}
  - netfilter: flowtable: validate vlan header {CVE-2024-44983}
  - usb: typec: fix potential out of bounds in ucsi_ccg_update_set_new_cam_cmd() {CVE-2024-50268}
  - usb: vhci-hcd: Do not drop references before new references are gained {CVE-2024-43883}
  - drm/amd/display: Fix slab-use-after-free on hdcp_work {CVE-2025-21968}
  - drm/amd/display: Check num_valid_sets before accessing reader_wm_sets[] {CVE-2024-46815}
  - drm/amd/display: Check index msg_id before read or write {CVE-2024-42121}
  - drm/amd/display: Check pipe offset before setting vblank {CVE-2024-42120}
  - drm/amdkfd: don't allow mapping the MMIO HDP page with large pages {CVE-2024-41011}
  - drm/amdkfd: Fix an illegal memory access {CVE-2023-53090}
  - drm/shmem-helper: Remove another errant put in error path {CVE-2023-53084}
  - drm/amd/display: fix shift-out-of-bounds in CalculateVMAndRowBytes {CVE-2023-53077}
  - drm/i915: mark requests for GuC virtual engines to avoid use-after-free {CVE-2023-53552}
  - ptp: fix integer overflow in max_vclocks_store {CVE-2024-40994}
  - nvmet: avoid potential UAF in nvmet_req_complete() {CVE-2023-53116}
  - loop: Fix use-after-free issues {CVE-2023-53111}
  - ftrace: Fix invalid address access in lookup_rec() when index is 0 {CVE-2023-53075}
  - mptcp: use the workqueue to destroy unaccepted sockets {CVE-2023-53072}
  - perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output {CVE-2023-53065}
  - erspan: do not use skb_mac_header() in ndo_start_xmit() {CVE-2023-53053}
  - HID: intel-ish-hid: ipc: Fix potential use-after-free in work function {CVE-2023-53039}
  - netlink: prevent potential spectre v1 gadgets {CVE-2023-53000}
  - coresight: Clear the connection field properly {CVE-2022-50214}
  - Bluetooth: btsdio: fix use after free bug in btsdio_remove due to race condition {CVE-2023-53145}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync {CVE-2025-39982}
  - x86/tdx: Fix "in-kernel MMIO" check {CVE-2024-47727}
  - arm64: sme: Use STR P to clear FFR context field in streaming SVE mode {CVE-2023-53713}
  - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read {CVE-2023-53710}


author: Sergei Nizovtsev <snizovtsev@cloudlinux.com> [5.14.0-284.1101.el9_2.tuxcare.7.els26]
changelog:
  - mm: hugetlb: fix UAF in hugetlb_handle_userfault {CVE-2022-50630}
  - drm/amdkfd: fix potential kgd_mem UAFs {CVE-2023-53816}
  - net/mlx5e: Fix deadlock in tc route query code {CVE-2023-53591}
  - PCI: Fix pci_device_is_present() for VFs by checking PF {CVE-2022-50636}
  - wifi: ath11k: fix monitor mode bringup crash {CVE-2022-50627}
  - wifi: mac80211_hwsim: drop short frames {CVE-2023-53321}
  - scsi: target: iscsi: Fix timeout on deleted connection {CVE-2025-38075}
  - amdgpu: validate offset_in_bo of drm_amdgpu_gem_va {CVE-2023-53819}
  - dmaengine: ptdma: check for null desc before calling pt_cmd_callback {CVE-2023-53755}
  - wifi: mt7601u: fix an integer underflow {CVE-2023-53679}
  - Bluetooth: hci_event: call disconnect callback before deleting conn {CVE-2023-53673}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails {CVE-2022-50087}
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails {CVE-2025-40176}
  - clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns {CVE-2025-38499}
  - net: openvswitch: reject negative ifindex {CVE-2023-53843}
  - drm/i915: Fix NULL ptr deref by checking new_crtc_state {CVE-2023-53833}
  - iommu/amd: Improve page fault error reporting {CVE-2023-53789}
  - media: v4l2-mem2mem: add lock to protect parameter num_rdy {CVE-2023-53519}
  - Bluetooth: Fix potential use-after-free when clear keys {CVE-2023-53386}
  - Bluetooth: L2CAP: Fix use-after-free {CVE-2023-53305}
  - ext4: add bounds checking in get_max_inline_xattr_value_size() {CVE-2023-53285}
  - ext4: fix use-after-free in ext4_orphan_cleanup {CVE-2022-50673}
  - cacheinfo: Fix shared_cpu_map to handle shared caches at different levels {CVE-2023-53254}
  - rxrpc: Make it so that a waiting process can be aborted {CVE-2023-53218}
  - ip6_vti: fix slab-use-after-free in decode_session6 {CVE-2023-53821}
  - vxlan: Fix nexthop hash size {CVE-2023-53192}
  - wifi: mac80211: check S1G action frame size {CVE-2023-53257}
  - wifi: rtlwifi: Fix global-out-of-bounds bug in _rtl8812ae_phy_set_txpower_limit() {CVE-2022-50279}
  - dm flakey: fix a crash with invalid table line {CVE-2023-53786}
  - md/raid10: fix null-ptr-deref in raid10_sync_request {CVE-2023-53832}
  - md: don't dereference mddev after export_rdev() {CVE-2023-53665}
  - md: fix 'delete_mutex' deadlock
  - md: fix duplicate filename for rdev {CVE-2023-53665}
  - kernfs: Fix UAF in polling when open file is released {CVE-2025-39881}
  - mptcp: pm: avoid possible UaF when selecting endp {CVE-2024-44974}
  - mptcp: fix UaF in listener shutdown {CVE-2023-53088}
  - Bluetooth: MGMT: Fix possible UAFs {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition
  - Bluetooth: MGMT: Fix possible deadlocks {CVE-2024-53207}
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). {CVE-2025-40186}
  - e1000e: fix heap overflow in e1000_set_eeprom {CVE-2025-39898}
  - wifi: cfg80211: fix use-after-free in cmp_bss() {CVE-2025-39864}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() {CVE-2025-38724}
  - usb: xhci: Apply the link chain quirk on NEC isoc endpoints {CVE-2025-22022}
  - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI {CVE-2025-39965}
  - xfrm: Duplicate SPI Handling {CVE-2025-39797}
  - nfsd: release svc_expkey/svc_export with rcu_work {CVE-2024-53216}
  - NFS: Fix a race when updating an existing write {CVE-2025-39697}
  - nfs: fold nfs_page_group_lock_subrequests into nfs_lock_and_join_requests
  - drm/amd/display: Check dce_hwseq before dereferencing it {CVE-2025-38361}


author: Vadim Panov <vpanov@cloudlinux.com> [almalinux9.2esu-5.14.0-284.1101.el9_2.tuxcare.7.els33]
changelog:
  - net: skbuff: propagate shared-frag marker through skb_gro_receive + skb_shift {CVE-2026-46300}
  - wifi: brcmfmac: Check the count value of channel spec to prevent out-of-bounds reads {CVE-2022-49740}


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-10
changelog:
  - weak-modules: group modules on add-kernel
  - weak-modules: do not make groups if there are no extra modules
    Resolves: rhbz#1649211


author: Yauheni Kaliuta <ykaliuta@redhat.com> - 25-16
changelog:
  - weak-modules: update_modules_for_krel: always finish sandbox
  - weak-modules: groupping: use dependencies of extra/ provider
    Resolves: rhbz#1778889


author: Tim Niemueller <tim@niemueller.de> - 5.1.4-7
changelog:
  - Add patch to from lua.org with smaller bugfixes
  - sed -i -e 's/5\.1\.3/5.1.4/g' on autotoolize patch, bug #641144


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-9
changelog:
  - KMODLVE-577: added forgotten lseek handlers to not crash kmodlve on CL9
  - KMODLVE-567: connect the ovz mark out event to the kmodlve callback


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-10
changelog:
  - KMODLVE-579: filemon fixes for CL9
  - KMODLVE-578: added dependency to tuned-profiles-cloudlinux that brings needed kernel params
  - KMODLVE-580: fixed redundant obsoletes for cl9
  - KMODLVE-581: added kmod dependency for cl9
  - KMODLVE-566: do not allow lve creation during lvp_destroy
  - CLKRN-1092: fix build for CL7


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-14
changelog:
  - CLKRN-1153: bump cl9 kernel version for module building
  - KMODLVE-587: enable access to ipv4 and ipv6 entries
  - KMODLVE-588: always update ppos in defaults_next


author: Linar Nadeev <lnadeev@cloudlinux.com> - 2.1-15
changelog:
  - CLKRN-1181: New Alma 9 kernel: -5.14.0-284.11.1.el9_2
  - KMODLVE-594: Prepare kmod-lve for kernel 9.2 build
  - KMODLVE-596: fix cgroup stat parsing


author: Anton Mikaiev <amikaiev@cloudlinux.com> - 2.1-16
changelog:
  - CLKRN-1176: added patch to fix ttypushback vulnerability
  - CLKRN-1195: bumped kernel version for building (cl8) for debug kernel compatibility
  - CLKRN-1093: allow freezable sleep in kmodlve


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-17
changelog:
  - CLKRN-1210: make new page cache accounting default for new installations
  - CLKRN-1089: do not account page cache memory in lve stats output


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-18
changelog:
  - CLKRN-1371: fixed kernel.proc_disable_net & introduced kernel.proc_disable_net2
  - CLKRN-1386: adapt kmodlve building with FEAT_LINK_PROT == 0


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-19
changelog:
  - KMODLVE-600: iolimits events support for CL8/9
  - KMODLVE-601: tag get/put events support
  - CLKRN-1406: revert some changes related to prod_net_disable2 - made the behaviour obliged
  - CLKRN-1355: symlink owner protection fixes for CL9
  - CLKRN-1399: improved fs.protected_symlinks_create option to close the SecureLink creating vulnerability


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-22
changelog:
  - CLKRN-1455: change kernel (cl9) building version for 5.14.0-362.13.1.el9_3
  - CLKRN-1203: switch back to using rh_reserved for tag links
  - CLKRN-1439: reduce warnings from external cgroup moves


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-24
changelog:
  - CLKRN-1488: rework security_* hooks
  - CLOS-2484: suppress the warning for nonexistent 90-cloudlinux.conf in the script


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-26
changelog:
  - CLKRN-1546: always block cgroup move in a multithreaded app
  - CLKRN-1547: stringify more lve_enter flags
  - CLKRN-1541: do not kill unkillable tasks from de_thread()
  - CLKRN-1542: do not allow to interrupt lve_unlink()
  - CLKRN-1457: fixed XFS_QMOPT_FORCE_RES for cl9 kernels


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-28
changelog:
  - CLKRN-1559: check if the ptr is invalid in lve_do_renameat2_trace hook
  - CLKRN-1566: improved restrictions on accessing another mnt ns


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-32
changelog:
  - CLKRN-1606: call missing putname within SP
  - CLKRN-1447: adapted minor log for moving tasks outside of LVEs


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-37
changelog:
  - CLKRN-1698: disable write access to process memory via procfs
  - CLKRN-1688: CL9.5 kernel support
  - CLKRN-1685: implement iolimits for LVP


author: Rostyslav Tulchii <rtulchii@cloudlinux.com> - 2.1-38
changelog:
  - CLKRN-1701: implement namespace check in __ptrace_may_access
  - CLKRN-1696: a switch to disable page cache accounting in lve pmem


