# changelog

author: Augusto Caringi <acaringi@redhat.com> [5.14.0-611.4.1.el9_7]
changelog:
  - drm/amdgpu: Include sdma_4_4_4.bin (Peter Colberg) [RHEL-117568]
  - redhat: use new x86/aarch64 signing key (801/804) (Augusto Caringi) [RHEL-116727]


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9d2e54f)
  - fixes "Excessive memory leak due to uncontrolled accumulation of health.log entries in Podman 5.x"
  - Resolves: RHEL-83262


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9ad4842)
  - fixes "Work on RHEL 9.7 packaging"
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/a994a04)
  - fixes "podman tests are failing"
  - Resolves: RHEL-86200


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/0ee1d49)
  - fixes "podman tests are failing - [RHEL-10.1.GA]"
  - Resolves: RHEL-88191


author: Jindrich Novy <jnovy@redhat.com> - 5:5.6.1-0.1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6
    (https://github.com/containers/podman/commit/d46b857)
  - fixes "Work on RHEL 9.7 packaging"
  - Related: RHEL-80816


author: Jindrich Novy <jnovy@redhat.com> - 5:5.6.0-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/56f1962)
  - fixes "Work on RHEL 9.7 packaging"
  - Related: RHEL-80816


author: Pavel Simovec <psimovec@redhat.com> - 1.9.3-2
changelog:
  - Apply upstream patch: MAINT:linalg:Adjust lwork/liwork changes OpenBLAS 0.3.26
  - Resolves: RHEL-70908


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-1
changelog:
  - Update to 3.11.13
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98044, RHEL-98014, RHEL-98237, RHEL-98176, RHEL-98205


author: Charalampos Stratakis <cstratak@redhat.com> - 3.11.13-2
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-101551


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.10-3
changelog:
  - Fix PySSL_SetError handling SSL_ERROR_SYSCALL
  - This fixes random flakiness of test_ssl on stressed machines
  Resolves: RHEL-88897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.11-1
changelog:
  - Update to 3.12.11
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98057, RHEL-98019, RHEL-97811, RHEL-98183, RHEL-98210


author: Vladis Dronov <vdronov@redhat.com> - 1.7.0-1
changelog:
  - Update to qatengine v1.7.0 @ ceb9d4ac (RHEL-47394)
  - Remove qat_contig_mem from upstream package
  - Add a condition to build as an OpenSSL provider


author: Vladis Dronov <vdronov@redhat.com> - 1.3.1-1
changelog:
  - Update to qatzip 1.3.1 @ 10dbadba (RHEL-73091, RHEL-50460)
  - Fix qatzip docker file build broken issue
  - Support Latency sensitive mode for qatzip
  - Add a suit of comp/decomp API to support Async offloading
  - Support zlib format and end of stream flag
  - Fix some bugs


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-20
changelog:
  - kvm-virtio-net-disable-USO-for-virt-rhel9.6.patch [RHEL-80313]
  - kvm-arm-Use-arm_virt_compat_set-to-apply-the-compat.patch [RHEL-80313]
  - kvm-file-posix-probe-discard-alignment-on-Linux-block-de.patch [RHEL-86032]
  - kvm-block-io-skip-head-tail-requests-on-EINVAL.patch [RHEL-86032]
  - kvm-file-posix-Fix-crash-on-discard_granularity-0.patch [RHEL-86032]
  - Resolves: RHEL-80313
    (Unable to migrate VM from RHEL10.0/qemu-kvm-9.6 to RHEL9.6/qemu-kvm-9.6)
  - Resolves: RHEL-86032
    (QEMU sends unaligned discards on 4K devices [RHEL-9.7])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-21
changelog:
  - kvm-meson-configure-add-valgrind-option-en-dis-able-valg.patch [RHEL-88153]
  - kvm-distro-add-an-explicit-valgrind-devel-build-dep.patch [RHEL-88153]
  - kvm-hw-i386-Fix-machine-type-compatibility.patch [RHEL-91307]
  - kvm-vfio-helpers-Refactor-vfio_region_mmap-error-handlin.patch [RHEL-88533]
  - kvm-vfio-helpers-Align-mmaps.patch [RHEL-88533]
  - Resolves: RHEL-88153
    ([s390x] valgrind not working with qemu-kvm for non-x86 builds)
  - Resolves: RHEL-91307
    (Fix x86 M-type compats)
  - Resolves: RHEL-88533
    (Improve VFIO mmapping performance with  huge  pfnmaps)


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-22
changelog:
  - kvm-migration-postcopy-Spatial-locality-page-hint-for-pr.patch [RHEL-85159]
  - kvm-Allow-guest-network-get-route-guest-get-load-QGA-com.patch [RHEL-91605 RHEL-91606]
  - Resolves: RHEL-85159
    (Video stuck about 1 min after switchover phase when play one video during postcopy-preempt migration)
  - Resolves: RHEL-91605
    ([qemu-guest-agent] Add new api 'guest-network-get-route' to allow-rpc [RHEL-9])
  - Resolves: RHEL-91606
    ([qemu-guest-agent] Enable 'guest-get-load' by default [RHEL-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-23
changelog:
  - kvm-net-vhost-user-add-QAPI-events-to-report-connection-.patch [RHEL-95120]
  - kvm-file-posix-Define-DM_MPATH_PROBE_PATHS.patch [RHEL-95408]
  - kvm-file-posix-Probe-paths-and-retry-SG_IO-on-potential-.patch [RHEL-95408]
  - Resolves: RHEL-95120
    (Allow libvirt to restart passt/vhost-user when the process is killed [rhel-9.7])
  - Resolves: RHEL-95408
    (Support multipath failover with scsi-block [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-24
changelog:
  - kvm-s390x-pci-add-support-for-guests-that-request-direct.patch [RHEL-11430]
  - kvm-s390x-pci-indicate-QEMU-supports-relaxed-translation.patch [RHEL-11430]
  - kvm-block-Expand-block-status-mode-from-bool-to-flags.patch [RHEL-82906 RHEL-83015]
  - kvm-file-posix-gluster-Handle-zero-block-status-hint-bet.patch [RHEL-82906 RHEL-83015]
  - kvm-block-Let-bdrv_co_is_zero_fast-consolidate-adjacent-.patch [RHEL-82906 RHEL-83015]
  - kvm-block-Add-new-bdrv_co_is_all_zeroes-function.patch [RHEL-82906 RHEL-83015]
  - kvm-iotests-Improve-iotest-194-to-mirror-data.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Minor-refactoring.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Pass-full-sync-mode-rather-than-bool-to-inter.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Allow-QMP-override-to-declare-target-already-.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Drop-redundant-zero_target-parameter.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Skip-pre-zeroing-destination-if-it-is-already.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Skip-writing-zeroes-when-target-is-already-ze.patch [RHEL-82906 RHEL-83015]
  - kvm-iotests-common.rc-add-disk_usage-function.patch [RHEL-82906 RHEL-83015]
  - kvm-tests-Add-iotest-mirror-sparse-for-recent-patches.patch [RHEL-82906 RHEL-83015]
  - kvm-mirror-Reduce-I-O-when-destination-is-detect-zeroes-.patch [RHEL-82906 RHEL-83015]
  - Resolves: RHEL-11430
    ([IBM 9.7 FEAT] KVM: Performance Enhanced Refresh PCI Translation - qemu part)
  - Resolves: RHEL-82906
    (--migrate-disks-detect-zeroes doesn't take effect for disk migration [rhel-9.7])
  - Resolves: RHEL-83015
    (Disk size of target raw image is full allocated when doing mirror with default discard value [rhel-9.7])


author: Miroslav Rezanina <mrezanin@redhat.com> - 9.1.0-25
changelog:
  - kvm-s390x-Fix-leak-in-machine_set_loadparm.patch [RHEL-98554]
  - kvm-hw-s390x-ccw-device-Fix-memory-leak-in-loadparm-sett.patch [RHEL-98554]
  - kvm-amd_iommu-Rename-variable-mmio-to-mr_mmio.patch [RHEL-66202]
  - kvm-amd_iommu-Add-support-for-pass-though-mode.patch [RHEL-66202]
  - kvm-amd_iommu-Use-shared-memory-region-for-Interrupt-Rem.patch [RHEL-66202]
  - kvm-amd_iommu-Send-notification-when-invalidate-interrup.patch [RHEL-66202]
  - kvm-amd_iommu-Check-APIC-ID-255-for-XTSup.patch [RHEL-66202]
  - kvm-io-Fix-partial-struct-copy-in-qio_dns_resolver_looku.patch [RHEL-67104]
  - kvm-util-qemu-sockets-Refactor-setting-client-sockopts-i.patch [RHEL-67104]
  - kvm-util-qemu-sockets-Refactor-success-and-failure-paths.patch [RHEL-67104]
  - kvm-util-qemu-sockets-Add-support-for-keep-alive-flag-to.patch [RHEL-67104]
  - kvm-util-qemu-sockets-Refactor-inet_parse-to-use-QemuOpt.patch [RHEL-67104]
  - kvm-util-qemu-sockets-Introduce-inet-socket-options-cont.patch [RHEL-67104]
  - kvm-tests-unit-test-util-sockets-fix-mem-leak-on-error-o.patch [RHEL-67104]
  - kvm-target-i386-Expose-bits-related-to-SRSO-vulnerabilit.patch [RHEL-52649]
  - kvm-target-i386-Add-PerfMonV2-feature-bit.patch [RHEL-52649]
  - kvm-target-i386-Update-EPYC-CPU-model-for-Cache-property.patch [RHEL-52649]
  - kvm-target-i386-Update-EPYC-Rome-CPU-model-for-Cache-pro.patch [RHEL-52649]
  - kvm-target-i386-Update-EPYC-Milan-CPU-model-for-Cache-pr.patch [RHEL-52649]
  - kvm-target-i386-Add-couple-of-feature-bits-in-CPUID_Fn80.patch [RHEL-52649]
  - kvm-target-i386-Update-EPYC-Genoa-for-Cache-property-per.patch [RHEL-52649]
  - kvm-target-i386-Add-support-for-EPYC-Turin-model.patch [RHEL-52649]
  - kvm-hw-i386-amd_iommu-Assign-pci-id-0x1419-for-the-AMD-I.patch [RHEL-70926]
  - kvm-hw-i386-amd_iommu-Isolate-AMDVI-PCI-from-amd-iommu-d.patch [RHEL-70925]
  - kvm-hw-i386-amd_iommu-Allow-migration-when-explicitly-cr.patch [RHEL-70925]
  - kvm-Enable-amd-iommu-device.patch [RHEL-70925]
  - kvm-include-qemu-compiler-add-QEMU_UNINITIALIZED-attribu.patch [RHEL-99888]
  - kvm-hw-virtio-virtio-avoid-cost-of-ftrivial-auto-var-ini.patch [RHEL-99888]
  - kvm-block-skip-automatic-zero-init-of-large-array-in-ioq.patch [RHEL-99888]
  - kvm-chardev-char-fd-skip-automatic-zero-init-of-large-ar.patch [RHEL-99888]
  - kvm-chardev-char-pty-skip-automatic-zero-init-of-large-a.patch [RHEL-99888]
  - kvm-chardev-char-socket-skip-automatic-zero-init-of-larg.patch [RHEL-99888]
  - kvm-hw-audio-ac97-skip-automatic-zero-init-of-large-arra.patch [RHEL-99888]
  - kvm-hw-audio-cs4231a-skip-automatic-zero-init-of-large-a.patch [RHEL-99888]
  - kvm-hw-audio-es1370-skip-automatic-zero-init-of-large-ar.patch [RHEL-99888]
  - kvm-hw-audio-gus-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-hw-audio-marvell_88w8618-skip-automatic-zero-init-of.patch [RHEL-99888]
  - kvm-hw-audio-sb16-skip-automatic-zero-init-of-large-arra.patch [RHEL-99888]
  - kvm-hw-audio-via-ac97-skip-automatic-zero-init-of-large-.patch [RHEL-99888]
  - kvm-hw-char-sclpconsole-lm-skip-automatic-zero-init-of-l.patch [RHEL-99888]
  - kvm-hw-dma-xlnx_csu_dma-skip-automatic-zero-init-of-larg.patch [RHEL-99888]
  - kvm-hw-display-vmware_vga-skip-automatic-zero-init-of-la.patch [RHEL-99888]
  - kvm-hw-hyperv-syndbg-skip-automatic-zero-init-of-large-a.patch [RHEL-99888]
  - kvm-hw-misc-aspeed_hace-skip-automatic-zero-init-of-larg.patch [RHEL-99888]
  - kvm-hw-net-rtl8139-skip-automatic-zero-init-of-large-arr.patch [RHEL-99888]
  - kvm-hw-net-tulip-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-hw-net-virtio-net-skip-automatic-zero-init-of-large-.patch [RHEL-99888]
  - kvm-hw-net-xgamc-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-hw-nvme-ctrl-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-hw-ppc-spapr_tpm_proxy-skip-automatic-zero-init-of-l.patch [RHEL-99888]
  - kvm-hw-usb-hcd-ohci-skip-automatic-zero-init-of-large-ar.patch [RHEL-99888]
  - kvm-hw-scsi-lsi53c895a-skip-automatic-zero-init-of-large.patch [RHEL-99888]
  - kvm-hw-scsi-megasas-skip-automatic-zero-init-of-large-ar.patch [RHEL-99888]
  - kvm-hw-ufs-lu-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-net-socket-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-net-stream-skip-automatic-zero-init-of-large-array.patch [RHEL-99888]
  - kvm-ui-vnc-Update-display-update-interval-when-VM-state-.patch [RHEL-100741]
  - Resolves: RHEL-98554
    ([s390x][RHEL9.7.0][virtio_block] there would be memory leak with virtio_blk disks)
  - Resolves: RHEL-66202
    ([AMDSERVER 9.6 Feature] qemu: Interrupt Remap support for emulated amd viommu)
  - Resolves: RHEL-67104
    (postcopy on the destination host can't switch into pause status under the network issue if boot VM with '-S')
  - Resolves: RHEL-52649
    ([AMDSERVER 9.6 Feature] Turin: Qemu EPYC-Turin Model)
  - Resolves: RHEL-70926
    (Qemu/amd-iommu: Advertise a suitable device id)
  - Resolves: RHEL-70925
    (Qemu/amd-iommu: Add ability to manually specify the AMDVI-PCI device)
  - Resolves: RHEL-99888
    (-ftrivial-auto-var-init=zero reduced performance [rhel-9])
  - Resolves: RHEL-100741
    (Video stuck after switchover phase when play one video during migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-26
changelog:
  - kvm-rbd-Fix-.bdrv_get_specific_info-implementation.patch [RHEL-108726]
  - Resolves: RHEL-108726
    (Openstack guest becomes inaccessible via network when storage network on the hypervisor is disabled/lost [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-27
changelog:
  - kvm-target-i386-Make-invtsc-migratable-when-user-sets-ts.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-Enable-fdp-excptn-only-and-zero-fcs-fds.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-kvm-i386-make-kvm_filter_msr-and-related-definitions.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-kvm-remove-unnecessary-ifdef.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-crypto-Define-macros-for-hash-algorithm-digest-lengt.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Drop-the-check-of-phys_bits-in-host_cpu_rea.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Extract-a-common-fucntion-to-setup-value-of.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Drop-the-variable-smp_cores-and-smp_threads.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Drop-cores_per_pkg-in-cpu_x86_cpuid.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-topology-Update-the-comment-of-x86_apicid_from_.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-topology-Introduce-helpers-for-various-topology.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Track-a-X86CPUTopoInfo-directly-in-CPUX86St.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Hoist-check-of-CPUID_EXT3_TOPOEXT-against-t.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-cpu-Remove-nr_cores-from-struct-CPUState.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Set-up-CPUID_HT-in-x86_cpu_expand_features-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Set-and-track-CPUID_EXT3_CMP_LEG-in-env-fea.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-Remove-unused-parameter-uint32_t-bit-in-feature.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-Print-CPUID-subleaf-info-for-unsupported.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-sev-Reduce-system-specific-declarations.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-physmem-replace-assertion-with-error.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-redhat-target-i386-add-CPUID-and-MSR-bits-from-Clear.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-qom-reverse-order-of-instance_post_init-calls.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-Remove-AccelCPUClass-cpu_class_init-need.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Consolidate-the-helper-to-get-Host-s-vendor.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-rocker-do-not-pollute-the-namespace.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-linux-headers-Update-to-Linux-v6.14-rc3.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-linux-headers-Update-to-Linux-v6.15-rc3.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-linux-headers-update-from-6.15-kvm-next.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-update-Linux-headers-to-v6.16-rc3.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-update-Linux-headers-to-KVM-tree-master.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-Introduce-tdx-guest-object.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Implement-tdx_kvm_type-for-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Implement-tdx_kvm_init-to-initialize-TDX-VM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Get-tdx_capabilities-via-KVM_TDX_CAPABILITI.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Introduce-is_tdx_vm-helper-and-cache-tdx_gu.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-kvm-Introduce-kvm_arch_pre_create_vcpu.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Initialize-TDX-before-creating-TD-vcpus.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-property-sept-ve-disable-for-tdx-guest-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Make-sept_ve_disable-set-by-default.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Wire-CPU-features-up-with-attributes-of-TD-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Validate-TD-attributes.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Support-user-configurable-mrconfigid-mrowne.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Set-APIC-bus-rate-to-match-with-what-TDX-mo.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Implement-user-specified-tsc-frequency.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-load-TDVF-for-TD-guest.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdvf-Introduce-function-to-parse-TDVF-metadata.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Parse-TDVF-metadata-for-TDX-VM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Don-t-initialize-pc.rom-for-TDX-VMs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Track-mem_ptr-for-each-firmware-entry-of-TD.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Track-RAM-entries-for-TDX-VM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-headers-Add-definitions-from-UEFI-spec-for-volumes-r.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Setup-the-TD-HOB-list.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-TDVF-memory-via-KVM_TDX_INIT_MEM_REGION.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Call-KVM_TDX_INIT_VCPU-to-initialize-TDX-vc.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Finalize-TDX-VM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Enable-user-exit-on-KVM_HC_MAP_GPA_RANGE.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Handle-KVM_SYSTEM_EVENT_TDX_FATAL.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Wire-TDX_REPORT_FATAL_ERROR-with-GuestPanic.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-kvm-Check-KVM_CAP_MAX_VCPUS-at-vm-level.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-introduce-x86_confidential_guest_cpu_instan.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-implement-tdx_cpu_instance_init.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Introduce-enable_cpuid_0x1f-to-force-exposi.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Force-exposing-CPUID-0x1f.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Set-kvm_readonly_mem_enabled-to-false-for-T.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Disable-SMM-for-TDX-VMs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Disable-PIC-for-TDX-VMs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Set-and-check-kernel_irqchip-mode-for-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Don-t-synchronize-guest-tsc-for-TDs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Only-configure-MSR_IA32_UCODE_REV-in-kvm_in.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-apic-Skip-kvm_apic_put-for-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-cpu-Don-t-set-vcpu_dirty-when-guest_state_protected.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cgs-Rename-mask_cpuid_features-to-adjust_cpuid_.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Implement-adjust_cpuid_features-for-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-TDX-fixed1-bits-to-supported-CPUIDs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-supported-CPUID-bits-related-to-TD-Attr.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-supported-CPUID-bits-relates-to-XFAM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Add-XFD-to-supported-bit-of-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Define-supported-KVM-features-for-TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cgs-Introduce-x86_confidential_guest_check_feat.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Fetch-and-validate-CPUID-of-TD-guest.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Don-t-treat-SYSCALL-as-unavailable.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Make-invtsc-default-on.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Validate-phys_bits-against-host-value.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-docs-Add-TDX-documentation.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Fix-build-on-32-bit-host.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdvf-Fix-build-on-32-bit-host.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-before-fe.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Error-and-exit-when-named-cpu-model-is-requ.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Rename-enable_cpuid_0x1f-to-force_cpuid_0x1.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Fix-the-typo-of-the-comment-of-struct-TdxGu.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Clarify-the-error-message-of-mrconfigid-mro.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-handle-TDG.VP.VMCALL-GetTdVmCallInfo.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-handle-TDG.VP.VMCALL-GetQuote.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-move-max_features-to-class.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-nvmm-whpx-add-accel-CPU-class-that-sets-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-allow-reordering-max_x86_cpu_initfn-vs-a.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-move-accel_cpu_instance_init-to-.instanc.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-merge-host_cpu_instance_init-and-host_cp.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Remove-enumeration-of-GetQuote-in-tdx_handl.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Set-value-of-GetTdVmCallInfo-based-on-capab.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-handle-TDVMCALL_SETUP_EVENT_NOTIFY_INTERRUP.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Fix-the-report-of-gpa-in-QAPI.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Remove-task-watch-only-when-it-s-valid.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Don-t-mask-off-CPUID_EXT_PDCM.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Move-x86_ext_save_areas-initialization-to-..patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-target-i386-tdx-fix-locking-for-interrupt-injection.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-cpu-Cleanup-host_cpu_max_instance_init.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-i386-tdx-Remove-the-redundant-qemu_mutex_init-tdx-lo.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-redhat-enable-CONFIG_TDX.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-redhat-allow-5-level-paging-for-TDX-VMs.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-memory-Export-a-helper-to-get-intersection-of-a-Memo.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-memory-Change-memory_region_set_ram_discard_manager-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-memory-Unify-the-definiton-of-ReplayRamPopulate-and-.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-ram-block-attributes-Introduce-RamBlockAttributes-to.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - kvm-physmem-Support-coordinated-discarding-of-RAM-with-g.patch [RHEL-15710 RHEL-20798 RHEL-49728]
  - Resolves: RHEL-15710
    ([Intel 9.7 FEAT] TDX: QEMU Support)
  - Resolves: RHEL-20798
    ([Intel 9.6 FEAT] TDX: host: Virt-QEMU: Add safe device pass-through for TD)
  - Resolves: RHEL-49728
    ([Intel 9.7 FEAT] Virt-QEMU: TDX: Allow to configure apic bus clock)


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-28
changelog:
  - kvm-target-i386-Expose-IBPB-BRTYPE-and-SBPB-CPUID-bits-t.patch [RHEL-17614]
  - Resolves: RHEL-17614
    (VM reports Vulnerable to spec_rstack_overflow when reading status in '/sys/devices/system/cpu/vulnerabilities/')


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-38
changelog:
  - Add support for spec local file attributes and generators (RHEL-52772)
  - Store configurable digest(s) on packages in rpmdb (RHEL-35619)
  - Fix a hard link race condition in brp-strip (RHEL-74011)


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.6-4
changelog:
  - Backport: https://github.com/coreos/rpm-ostree/pull/5322
    Backport: https://github.com/coreos/rpm-ostree/pull/5339
    Resolves: #RHEL-84466


author: Attila Lakatos <alakatos@redhat.com> - 8.2506.0-1
changelog:
  - Rebase to 8.2506.0
  - imuxsock: track dropped messages by ratelimiting
    Resolves: RHEL-66274
  - man page version update
    Resolves: RHEL-78220
  - omfwd: do not hang forever in case of broken TLS handshake
    Resolves: RHEL-67639


author: Jarek Prokop <jprokop@redhat.com> - 3.3.5-3
changelog:
  - Upgrade to Ruby 3.3.5
    Resolves: RHEL-55411
  - Fix DoS vulnerability in rexml.
    (CVE-2024-39908)
    (CVE-2024-41946)
    (CVE-2024-43398)
    Resolves: RHEL-57575
    Resolves: RHEL-57572
    Resolves: RHEL-57068
  - Fix REXML DoS when parsing an XML having many specific characters such as
    whitespace character, >] and ]>.
    (CVE-2024-41123)
    Resolves: RHEL-57569
  - Fix incorrect symlink for rubygem-irb's library.
    Resolves: RHEL-42646


author: Jarek Prokop <jprokop@redhat.com> - 3.3.8-4
changelog:
  - Upgrade to Ruby 3.3.8.
    Resolves: RHEL-68631
  - Fix Net::IMAP vulnerable to possible DoS by memory exhaustion. (CVE-2025-25186)
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86109
  - Fix userinfo leakage in URI#join, URI#merge and URI#+. (CVE-2025-27221)


author: Jindrich Novy <jnovy@redhat.com> - 4:1.2.5-2
changelog:
  - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
  - Resolves: RHEL-122402
  - Resolves: RHEL-122404
  - Resolves: RHEL-122415


author: Dan Horák <dhorak@redhat.com> - 2:2.36.0-2.1
changelog:
  - Add machine type definition for machines 9175 and 9176 (RHEL-90167)
  - Install zkey related modules and tools into initrd (RHEL-96733)
  - Resolves: RHEL-90167 RHEL-96733


author: Dan Horák <dhorak@redhat.com> - 2:2.36.0-2.2
changelog:
  - libekmfweb: Fix generation of certificate or CSR with RSA-PSS instead of RSA (RHEL-115827)
  - chpstat: Fix scaling of DPU utilization calculation (RHEL-115842)
  - chpstat: Add missing CMG 5 data fields (RHEL-115842)
  - chpstat: Fix DPU utilization calculation (RHEL-115842)
  - zkey: Adjust CCA host library version detection for newer CCA versions (RHEL-115846)
  - Resolves: RHEL-115827 RHEL-115842 RHEL-115846


author: Dan Horák <dhorak@redhat.com> - 2:2.38.0-1
changelog:
  - rebased to 2.38.0 (RHEL-73342)
  - LPAR level power consumption reporting (RHEL-72675)
  - Provide Topology-Map information to userspace (RHEL-72682)
  - Add CCK secret type for updating the Customer Communication Key (RHEL-73021)
  - Convert LUKS2 volume from AES keys to retrievable PAES keys (RHEL-85390)
  - Resolves: RHEL-73342 RHEL-72675 RHEL-72682 RHEL-73021 RHEL-85390


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.22.4-5
changelog:
  - resolves: RHEL-101761 - Fix DC discovery after Windows netlogon hardening
    (follow-up, main fix is in samba-4.22.2-4.el9)


author: Petr Lautrbach <lautrbach@redhat.com> - 3.3.35-1
changelog:
  - Update tmpfiles.d config (bz#2346971)
  - Do not hardcode /var/lib/selinux as store_root
  - data: update app icon
  - Enable Georgian and Arabic (ar) languages in configure.ac
  - Update translations
  - Ship with contemporary app icon
  - Check that SELinux is enabled before running (rhbz#2178950)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.18.1-1
changelog:
  - update to the latest content of https://github.com/containers/skopeo/tree/release-1.18
    (https://github.com/containers/skopeo/commit/bfd0850)
  - fixes "CVE-2025-27144 skopeo: Go JOSE's Parsing Vulnerable to Denial of Service [rhel-9.7]"
  - Resolves: RHEL-80616


author: Jindrich Novy <jnovy@redhat.com> - 1.3.3-1
changelog:
  - update to https://github.com/rootless-containers/slirp4netns/releases/tag/v1.3.3
  - Resolves: RHEL-94765


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-20
changelog:
  - Resolves: RHEL-77282 - ”TCP connection to XX.XX.XX.XX/XXXX failed” message is
    output frequently on RHEL9


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-1
changelog:
  - Resolves: RHEL-92622 - Rebase SSSD for RHEL 9.7
  - Resolves: RHEL-87205 - SSSD fails to connect with ipv4_first when on a machine with only IPv6 and server is dual-stack [rhel-9]
  - Resolves: RHEL-73906 - OAuth2 using UPN attribute from Entra ID
  - Resolves: RHEL-92590 - SSSD LDAPU1 Mapping braces problem [rhel-9]
  - Resolves: RHEL-90136 - backport https://github.com/SSSD/sssd/pull/7649


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-3
changelog:
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
  - Resolves: RHEL-103434 - cache_credentials = true not working


author: Alexey Tikhonov <atikhono@redhat.com> - 2.9.7-4
changelog:
  - Related: RHEL-87530 - AD user in external group is not cleared when expiring the cache [rhel-9]
    Patch used to fix this ticket causes a regression (RHEL-106987) and is being reverted.


author: Wander Lairson Costa <wander@redhat.com> - 1.20.3-1
changelog:
  - Rebase to stalld-1.20.3
  - Make systemd start stalld with the SCHED_FIFO:10 priority
  Resolves: RHEL-109088


author: Wander Lairson Costa <wander@redhat.com> - 1.20.4-1
changelog:
  - Rebase to stalld-1.20.4
  - Remove duplicated ExecStart entry from the stalld.service file
  Resolves: RHEL-108827


author: Radovan Sroka <rsroka@redhat.com> - 1.9.5p2-13
changelog:
  RHEL: 9.7.0 ERRATUM
  - sudo missing spacing and separator in log when using "--preserve-env=list"
  Resolves: RHEL-71916
  - CVE-2025-32462 sudo: LPE via host option
  Resolves: RHEL-100020


author: systemd maintenance team <systemd-maint@redhat.com> - 252-52
changelog:
  - man: be even clearer that tmpfiles user/group/mode are applied on existing inodes (RHEL-15051)
  - unit: always return 1 in log_kill (RHEL-78170)
  - ci: enable mkosi workflow for z-stream branches (RHEL-79977)
  - ci(mkosi): bump fedora version from 39 to 41 (RHEL-79977)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-53
changelog:
  - man: mention that rhel-9.0 net naming scheme is the same as v251 (RHEL-86891)
  - backlight: Drop support for actual_brightness (RHEL-86714)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-54
changelog:
  - unit: add conditions and deps to make oomd.socket and .service consistent (RHEL-90417)
  - udev/net_id: introduce naming scheme for RHEL-9.7 (RHEL-25516)
  - Add a set of assertion macros to tests.h (ASSERT_OK(), ASSERT_EQ(), ASSERT_GE(), ASSERT_LE()) that log the failed condition before crashing and convert test-gpt.c test file to use them (RHEL-103753)
  - Follow up with the PR #31819 (RHEL-103753)
  - Added more ASSERT macro and also make some test file to use them (RHEL-103753)
  - sd-event: drop inotify event from buffer when no event source is triggered (RHEL-103753)
  - test: add test case for issue #38265 (RHEL-103753)
  - test: answer 2nd mdadm --create question for compat with new version (RHEL-79977)
  - sysusers: cross-check user and group names too (RHEL-72572)
  - test-sysusers: check group creation with matching user entry (RHEL-72572)
  - user-sessions: do not remove /etc/nologin (RHEL-85467)
  - hwdb: f20 → micmute (RHEL-72697)
  - hwdb: f21 → touchpad_toggle (RHEL-72697)
  - hwdb: f22 → touchpad_on (RHEL-72697)
  - hwdb: f23 → touchpad_off (RHEL-72697)
  - hwdb: drop some now redundant mappings (RHEL-72697)
  - hwdb: Add micmute for System76 (RHEL-72697)
  - hwdb: Add newer System76 Pangolins (RHEL-72697)
  - hwdb: WALTOP International Corp. Slim Tablet Stylus (RHEL-72697)
  - hwdb: add MSI Claw 8 AT Keyboard Scancodes (#36180) (RHEL-72697)
  - Adds asus T103HAF rotation matrix to 60-sensor.hwdb (#36177) (RHEL-72697)
  - hwdb: fix screen rotation for EXO Wings 2in1 w1125 (#36283) (RHEL-72697)
  - hwdb: XBox Series Elite controller modalias entry has been added. (#36305) (RHEL-72697)
  - hwdb: add front button support for MSI Claw 7 AI+ A2VM (RHEL-72697)
  - hwdb: add accel orientation and location for the BMAX Y14 (RHEL-72697)
  - hwdb.d: add support for Akoya P15645 (RHEL-72697)
  - hwdb.d: add ANP09 Intel n100 tablet sensor configuration (#36390) (RHEL-72697)
  - hwdb: add axis range corrections for the Lenovo Yoga Slim 7 14ARE05 (RHEL-72697)
  - hwdb: add GOLD WARRIOR SIM PhoenixRC 10411R (RHEL-72697)
  - hwdb: add Code Mercenaries Hard- und Software GmbH Virtual RC USB (RHEL-72697)
  - hwdb: Add accel orientation quirk for the GPD Pocket 4 (RHEL-72697)
  - hwdb: add rotation profile matrix for Rog Ally X (2024) (#36591) (RHEL-72697)
  - hwdb: fix backspace not working on HP Pavilion laptop (#36777) (RHEL-72697)
  - hwdb/keyboard: Map FN key on TUXEDO NB02 devices (RHEL-72697)
  - hwdb: add G-Mode key support (#37175) (RHEL-72697)
  - hwdb/keyboard: Map FN key on TUXEDO InfinityFlex 14 Gen1 (RHEL-72697)
  - hwdb: add HP 150 Wired Mouse (#37341) (RHEL-72697)
  - Add emulated release to G-Mode key (RHEL-72697)
  - hwdb: keyboard: Add Alienware special keys (RHEL-72697)
  - hwdb: add bladeRF SDR devices (RHEL-72697)
  - hwdb: append ID_SOFTWARE_RADIO to hwdb parser (RHEL-72697)
  - hwdb.d: reword and simplify boilerplate texts (RHEL-72697)
  - hwdb.d: update/expand boilerplate on various hwdb files (RHEL-72697)
  - hwdb: say that settings can be also set to 0 (RHEL-72697)
  - hwdb: add Analog Devices PLUTO SDR (RHEL-72697)
  -  hwdb: append ID_MM_DEVICE_IGNORE to hwdb parser (RHEL-72697)
  - hwdb: run "update-hwdb" (RHEL-72697)
  - hwdb: run "update-hwdb-autosuspend" (RHEL-72697)
  - hwdb: add missing PLUTO SDR vendor name (RHEL-72697)
  - hwdb: add Ettus Research SDR devices (RHEL-72697)
  - hwdb: add RTL-SDR devices (RHEL-72697)
  - hwdb: merge entries for Ettus Research B200 (RHEL-72697)
  - hwdb: make Saitek PLC Pro Flight Rudder Pedals a joystick (#37601) (RHEL-72697)
  - hwdb: fix touchpad for ASUS X1504ZA (#37696) (RHEL-72697)
  - hwdb: add support for Loupedeck devices (RHEL-72697)
  - hwdb: Acer Nitro ANV15-51 Mic Toggle (RHEL-72697)
  - hwdb: Added Beacn and TC-Helicon Audio controllers (#37798) (RHEL-72697)
  - hwdb: Add support for Lenovo IdeaPad Slim 5 series (RHEL-72697)
  - hwdb: Add hwbd definitions for maker tools (RHEL-72697)
  - hwdb: Add accel orientation quirk for the Microtech e-tab Pro (RHEL-72697)
  - hwdb: add 70-maker-tools.hwdb to meson.build (RHEL-72697)
  - hwdb: fix typo in 70-maker-tools.hwdb (RHEL-72697)
  - hwdb: update (RHEL-72697)
  - Fix Positivo K116J search key and www shortcut (RHEL-72697)
  - hwdb: Acer Nitro ANV15-51 Nitro Sense Toggle (RHEL-72697)
  - hwdb: several cleanups (RHEL-72697)
  - hwdb: disable Asus ROG keyboards sending poweroff (RHEL-72697)
  - hwdb: update (RHEL-72697)
  - hwdb: update autosuspend rules (RHEL-72697)
  - hwdb: set touchpad resolution for ThinkPad T14 Gen2a (RHEL-72697)
  - Revert "hwdb: disable Asus ROG keyboards sending poweroff" (RHEL-72697)
  - hwdb: Add launch emoji keyboard mapping for Asus M1607KA (RHEL-72697)
  - Enable KEY_PERFORMANCE key present on Linux 6.17 (RHEL-72697)
  - flush_ports: flush POSIX message queues properly (RHEL-90860)
  - kernel-install: add --entry-type=type1|type2 option to kernel-install (RHEL-83932)
  - kernel-install: add --entry-type=type1|type2 option to kernel-install.in (RHEL-83932)
  - kernel-install: do not mix || and && (RHEL-83932)
  - man/kernel-install: mention --entry-type= option in the man page (RHEL-83932)
  - cgroup: add support for memory.peak (RHEL-95797)
  - core: include peak memory in unit_log_resources() (RHEL-95797)
  - run: include peak memory in output (RHEL-95797)
  - core: ensure init.scope is realized after drop-ins have been loaded (RHEL-103488)
  - core: add possibility to not track certain unit types (RHEL-89796)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55
changelog:
  - tree-wide: check more log message format in log_struct() and friends (RHEL-100353)
  - build: add some coloring to --version output (RHEL-100353)
  - core: output log cycle path in one log message, not many (RHEL-100353)
  - core: make log cycle messages recognizable via message IDs (RHEL-100353)
  - core: change ordering cycle log message log levels (RHEL-100353)
  - core: cast log_oom() got void (RHEL-100353)
  - core: when removing a job from a transaction, include in structured log message which (RHEL-100353)
  - catalog: add entries for the order cycle log messages (RHEL-100353)
  - tree-wide: check more log message format in log_struct() and friends (RHEL-100353)
  - core/transaction: do not attempt to log "n/a" as a journal field (RHEL-100353)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-51.3
changelog:
  - meson: /etc/systemd/network is also used by udevd (RHEL-111610)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-111629)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111629)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111629)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-111629)
  - core: do not disconnect from bus when failed to install signal match (RHEL-111629)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111629)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111629)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111629)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111629)
  - core/manager: drop duplicate bus track deserialization (RHEL-111629)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111629)


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-1
changelog:
  - 1.15.0
    Resolves: RHEL-78617
  - Add SELinux policy rules allowing to access /proc/sys/fs/nr_open
    Resolves: RHEL-77973
  - Add SELinux policy rules allowing to create directories under /root
    Resolves: RHEL-77975
  - Fix CVE-2025-26594 xorg-x11-server Use-after-free of the root cursor
    Resolves: RHEL-80208
  - Fix CVE-2025-26595 xorg-x11-server Buffer overflow in XkbVModMaskText()
    Resolves: RHEL-80189
  - Fix CVE-2025-26596 xorg-x11-server Heap overflow in XkbWriteKeySyms()
    Resolves: RHEL-80194
  - Fix CVE-2025-26597 xorg-x11-server Buffer overflow in XkbChangeTypesOfKey()
    Resolves: RHEL-80196
  - Fix CVE-2025-26598 xorg-x11-server Out-of-bounds write in CreatePointerBarrierClient()
    Resolves: RHEL-80197
  - Fix CVE-2025-26599 xorg-x11-server Use of uninitialized pointer in compRedirectWindow()
    Resolves: RHEL-80206
  - Fix CVE-2025-26600 xorg-x11-server Use-after-free in PlayReleasedEvents()
    Resolves: RHEL-80205
  - Fix CVE-2025-26601 xorg-x11-server Use-after-free in SyncInitTrigger()
    Resolves: RHEL-80209


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-5
changelog:
  - Fix CVE-2025-49175: xorg-x11-server: Out-of-Bounds Read in X Rendering Extension Animated Cursors
    Resolves: RHEL-97284

  - Fix CVE-2025-49176: xorg-x11-server: Integer Overflow in Big Requests Extension
    Resolves: RHEL-97303

  - Fix CVE-2025-49178: xorg-x11-server: Unprocessed Client Request Due to Bytes to Ignore
    Resolves: RHEL-97379

  - Fix CVE-2025-49179: xorg-x11-server: Integer overflow in X Record extension
    Resolves: RHEL-97414

  - Fix CVE-2025-49180: xorg-x11-server: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
    Resolves: RHEL-97429


author: Jan Grulich <jgrulich@redhat.com> - 1.14.1-9
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119987

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120006

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120769


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-65
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-81721
  - Remove deprecated path from systemd service file
    Resolves: RHEL-81716


author: Mark Wielaard <mjw@redhat.com> - 3.24.0-4
changelog:
  - Split main valgrind package into several subpackages:
    - valgrind now contains just the core tools.
    - valgrind-scripts contains the post-processing scripts for callgrind,
      cachegrind, massif and dhat which depend on perl and python.
    - valgrind-gdb contains the debuginfo client/server and (v)gdb support.
    - valgrind-docs contains the man pages, html and pdf manual.
  - Adjust Requires/Recommends to subpackages can be installed independently.
    - valgrind-devel now Recommends, instead of Requires, valgrind.
    - valgrind-gdb Requires valgrind
    - valgrind-scripts Recommends valgrind-gdb
    - valgrind-gdb Recommends gdb


author: Mark Wielaard <mjw@redhat.com> - 3.25.1-2
changelog:
  - Add VALGRIND_3_25_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.25.x-fixes.patch
    - 0002-Bug-503241-s390x-Support-z17-changes-to-the-NNPA-ins.patch


author: Remi Collet <rcollet@redhat.com> - 7.2.6.1
changelog:
  - rebase to 7.2.6
  - merge limit.conf in main service files
  - drop /etc/sysconfig/valkey
  - rename compat package
  - fix working dir
  - partially enable upstream test suite


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-22.1
changelog:
  - RHEL-112006 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112010 CVE-2025-53906 vim: Vim path traversal


author: Richard W.M. Jones <rjones@redhat.com> - 1:2.7.1-16
changelog:
  - mlcustomize: Remove dnf --verbose option
    resolves: RHEL-83289
  - Print blkhash of converted image in virt-v2v debugging output
    resolves: RHEL-85512
  - Print nbdcopy command in debug output
    resolves: RHEL-86022
  - Turn live domain error into a warning
    resolves: RHEL-88543
  - Remove usage of nbdkit-cacheextents-filter
    resolves: RHEL-88857
  - Print better mountpoint stats in debug output
    resolves: RHEL-88861
  - Remove several ancient, deprecated options
    resolves: RHEL-88866
  - New tool: virt-v2v-open
    resolves: RHEL-88985
  - Remove virt-v2v -io vddk-noextents=true option
    resolves: RHEL-102618
  - Fix installation of drivers on firstboot with pending reboots
    resolves: RHEL-100682


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119961), CVE-2025-62230 (RHEL-120032),
                 CVE-2025-62231 (RHEL-125001)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-28
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80201), CVE-2025-26595 (RHEL-80186),
                 CVE-2025-26596 (RHEL-80188), CVE-2025-26597 (RHEL-80191),
                 CVE-2025-26598 (RHEL-80192), CVE-2025-26599 (RHEL-80199),
                 CVE-2025-26600 (RHEL-80198), CVE-2025-26601 (RHEL-80200)


author: Michel Dänzer <mdaenzer@redhat.com> - 1.20.11-30
changelog:
  - xfree86: Fix potentially NULL reference to platform device's PCI device
    Resolves: https://issues.redhat.com/browse/RHEL-84253


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-31
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97285), CVE-2025-49176 (RHEL-97308),
                 CVE-2025-49178 (RHEL-97387), CVE-2025-49179 (RHEL-97409),
                 CVE-2025-49180 (RHEL-97253)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119975), CVE-2025-62230 (RHEL-120020),
                 CVE-2025-62231 (RHEL-125016)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-3
changelog:
  - CVE fix for: CVE-2025-26594 (RHEL-80204), CVE-2025-26595 (RHEL-80187),
                 CVE-2025-26596 (RHEL-80190), CVE-2025-26597 (RHEL-80193),
                 CVE-2025-26598 (RHEL-80195), CVE-2025-26599 (RHEL-80202),
                 CVE-2025-26600 (RHEL-80203), CVE-2025-26601 (RHEL-80207)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-4
changelog:
  - CVE fix for: CVE-2025-49175 (RHEL-97288), CVE-2025-49176 (RHEL-97334),
                 CVE-2025-49177 (RHEL-97357), CVE-2025-49178 (RHEL-97393),
                 CVE-2025-49179 (RHEL-97404), CVE-2025-49180 (RHEL-97244)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.53.1-1
changelog:
  - Update to 1.53.1 (dev)
  - Update MPTCP endpoints creation order (RHEL-78752)
  - Print all warnings from nmcli to stderr (RHEL-74255)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.2-1
changelog:
  - Update to 1.53.2 (dev)
  - Fix invalid memory access on Dnsconfd DBUS error (RHEL-83175)
  - Avoid getting transient hostname when "localhost" set in /etc/hostname (RHEL-55730)


author: Filip Pokrývka <fpokryvk@redhat.com> - 1:1.53.3-1
changelog:
  - Update to 1.53.3 (dev)
  - Add more IPv6 prefix delegation options (RHEL-85765)
  - Fix order of parsing port/controller properties in nmcli (RHEL-85767)
  - Improve interface activation logic (RHEL-85766)
  - Fix WireGuard IPv6 firewall rules (RHEL-85763)
  - Support OVS-DPDK dpdk-lsc-interrupt and mtu_request configurations (RHEL-77148)


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)

  Resolves: RHEL-83061
  Resolves: RHEL-59083
  Resolves: RHEL-87596
  Resolves: RHEL-85770
  Resolves: RHEL-85764
  Resolves: RHEL-85778
  Resolves: RHEL-87168


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.90-1
changelog:
  - Update to 1.54.0 (rc1)
  - Devices not becoming managed sometimes (RHEL-93108)
  - Crash on _l3cfg_notify_cb (RHEL-92314)
  - Fix autoconnect-ports for unrealized VLANs and other virtual devices (NMT-1610)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.91-1
changelog:
  - Update to 1.54.0 (rc2)
  - Support deactivating a connection without resetting SRIOV sriov_numvfs (RHEL-98728)
  - Fix a race condition in ovs tun interface (RHEL-98551)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.53.92-1
changelog:
  - Update to 1.54.0 (rc3)
  - Fix ipv6 static route deleted with dualstack (RHEL-102772)
  - Allow setting IP method to disabled in port connection (RHEL-102768)


author: Filip Pokryvka <fpokryvk@redhat.com> - 1:1.54.0-1
changelog:
  - Update to 1.54.0
  - Fix reaply on bridge port VLAN (RHEL-102743)
  - Accept hostnames longer than 64 characters from DNS lookup (RHEL-106787)


author: Attila Lakatos <alakatos@redhat.com> - 3.1.5-5
changelog:
  - ausearch: correct search for DAEMON related events
  - allow hex digits when interpreting tty data
    Resolves: RHEL-82279
  - Fix TTY hostname in log messages
    Resolves: RHEL-78323


author: Nick Clifton <nickc@redhat.com> - 2.35.2-67
changelog:
  - Adds tests for the linker's --error-execstack and --error-rwx-segments command line options.  (RHEL-109970)


author: Jacek Migacz <jmigacz@redhat.com> - 7.76.1-32
changelog:
  - make up incomplete patch for host name wildcard checking (RHEL-5675)
  - eliminate use of obsolete patch syntax (RHEL-65791)
  - http2: make sure pause is done on HTTP (RHEL-85847)


author: Pavel Valena <pvalena@redhat.com> - 057-101.git20250808
changelog:
  - fix(systemd): add missing modprobe@.service
  - fix: let check_vol_slaves_all return 1 when checks on all
  - improvement(74nvmf): lookup required NIC kernel modules for
  - fix(74nvmf): set root=nvmf
  - chore(multipath): remove `rd_NO_MULTIPATH` kernel command
  - refactor(multipath): remove custom multipathd.service
  - fix(systemd): systemd.volatile needs overlayfs kernel module
  - refactor(dracut): introduce clamp_mtimes helper function
  - fix(dracut): ensure hardlink deduplication is reproducible


author: Joan Torres <joantolo@redhat.com> - 40.1.1-11
changelog:
  - Add race fixes needed when terminating a conflicting session
    on GDM greeter.
    Resolves: RHEL-92341


author: Felipe Borges <feborges@redhat.com> - 40.0.1-22
changelog:
  - Use mount path in "Low disk" notification when multiple mount points have same name
    Related: RHEL-11910


author: Miroslav Lichvar <mlichvar@redhat.com> 4.4-2
changelog:
  - add experimental option for external PPS in ts2phc automatic mode
    (RHEL-72468)
  - add command to set external grandmaster properties (RHEL-90585)
  - refresh link status on faults (RHEL-56168)


author: Lili Du <ldu@redhat.com> - 13.0.0-1
changelog:
  - Rebase to 13.0.0 [RHEL-99158]
  - Resolves: RHEL-99158 
    ([ESXi][RHEL9] open-vm-tools version 13.0.0 has been released - please rebase)


author: Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-1.el9_7.1
changelog:
  - ovt-Address-CVE-2025-41244.patch [RHEL-117395]
  - Resolves: RHEL-117395
    ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.7])


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.2.2-7
changelog:
  - RFC7250 handshakes with unauthenticated servers don't abort as expected (CVE-2024-12797)
    Resolves: RHEL-76756


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-1
changelog:
  - Rebasing OpenSSL to 3.5
    Resolves: RHEL-80854
    Resolves: RHEL-50208
    Resolves: RHEL-50210
    Resolves: RHEL-50211
    Resolves: RHEL-85954


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-2
changelog:
  - OpenSSL ignores "rh-allow-sha1-signatures = yes" option on RHEL-9
    Resolves: RHEL-88910
  - PKCS#12 should not default to pbmac1 in FIPS mode in RHEL-9
    Resolves: RHEL-88912
  - Fix `openssl speed` running in FIPS mode
    Resolves: RHEL-89860
  - pkeyutl ecdsa signature with sha1 shouldn't work by default
    Resolves: RHEL-89861
  - Expose settable params for EVP_SKEY
    Resolves: RHEL-89862
  - Restore RHEL9-style indicators defines
    Resolves: RHEL-89859
  - Enable sslkeylog support
    Resolves: RHEL-90854


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.0-4
changelog:
  - Compact patches for better maintainability
    Related: RHEL-80854
  - Make hybrid MLKEM work with our FIPS provider (3.0.7)
    Resolves: RHEL-95239


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-2
changelog:
  - Move fips.so to a seprate subpackage
    Reverts FIPS self test for SLH-DSA
    Add Suggests to try to prefer the openssl-fips-provider package
    over the fips-provider-next package by default
    Revolves: RHEL-102408
    Related: RHEL-80854


author: Simo Sorce <simo@redhat.com> - 1:3.5.1-3
changelog:
  - Add custom define to disable symbol versioning in downstream patched code
    Also add stricter Suggests for openssl-fips-provider
    Resolves: RHEL-104236
  - Fix Requires/Provider to fix default install of fips providers
    Resolves: RHEL-104856


author: Iker Pedrosa <ipedrosa@redhat.com> - 1.5.1-26
changelog:
  - pam_unix: sync expiry checks with shadow.
    Resolves: RHEL-70519, RHEL-95475, RHEL-96955 and RHEL-96973
  - pam.conf: remove tallylog. Resolves: RHEL-15324
  - pam_namespace: fix potential privilege escalation.
    Resolves: CVE-2025-6020 and RHEL-96727


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.23-1
changelog:
  - Update to 3.9.23
  - Security fixes for CVE-2025-4517, CVE-2025-4330, CVE-2025-4138, CVE-2024-12718, CVE-2025-4435
  Resolves: RHEL-98051, RHEL-98024, RHEL-98242, RHEL-98193, RHEL-98218


author: Tyonnchie Berry <tyberry@redhat.com> - 2.8-5
changelog:
  -  Added patch Fix-rt-tests-build-with-glibc-2.41.patch
  -  Added patch Revert-Fix-rt-tests-build-with-glibc-2.41.patch
  -  Added patch sched_attr-Do-not-define-for-glibc-2.41.patch
  Resolves: RHEL-88469


author: Tyonnchie Berry <tyberry@redhat.com> - 2.9-1
changelog:
  - Rebased to latest upstream version
  - Dropped previously applied patches
  - Cleaned up spec file
  Resolves: RHEL-86704


author: Debarshi Ray <rishi@fedoraproject.org> - 0.2-2
changelog:
  - Update to 0.2
  - Fix CVE-2025-23266, CVE-2025-23267, and GHSA-fv92-fjc5-jj9h or GO-2025-3787
  Resolves: RHEL-104455


author: Pavel Reichl <preichl@redhat.com> - 6.4.0-7
changelog:
  - xfs unrepairable filesystem if directory block not junked in phase 3 - more
  - fixes
  - Related: RHEL-54342


author: Vladimír Beneš <vbenes@redhat.com> - 1:1.53.4-1
changelog:
  - Update to 1.53.4 (dev)
  - initrd: add new NBFT parser (RHEL-83061)
  - Add support for configuring per-device IPv4 sysctl forwarding option in NetworkManager (RHEL-59083)
  - Support reapply on OVS settings (RHEL-86877)
  - Add support for configuring the loopback interface in nmtui (RHEL-85770)
  - Replace ioctl wth netlink for ethtool in NetworkManager (RHEL-85764)
  - NetworkManager does not add the `lock` attribute when `rto_min` is used (RHEL-85778)
  - Can not change `bridge.options.mcast-snooping-enable` on partial managemd OVS bridge (RHEL-87168)


author: Vladimír Beneš <vbenes@redhat.com 1.2.27-1
changelog:
  - Update to 1.2.27 version
  - Add support for nm-auto-defaults + symetric import/export (RHEL-118843)
  - Support leftsendcert in X.509-Based VPN (RHEL-110772)
  - Support rightca in ipsec section
  - Esp param properly exported


author: Gris Ge <fge@redhat.com> - 1.2.29-1
changelog:
  - Upgrade to 1.2.29
  - Fix error on duplicate key 'phase2alg'. (RHEL-131232)
  - Fix import connection with RSA key. (RHEL-127865)


author: Petr Menšík <pemensik@redhat.com> - 32:9.16.23-34.1
changelog:
  - Prevent cache poisoning due to weak PRNG (CVE-2025-40780)
  - Replace downstream fixes with upstream changes
  - Address various spoofing attacks (CVE-2025-40778)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.4-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/ee5b574)
  - fixes "buildah: create parent directories of mount targets with mode 0755 - [RHEL-9.7]  0day"
  - Resolves: RHEL-115166


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.6-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/2ece502)
  - fixes "[Minor Incident] CVE-2025-52881 buildah: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-9.7.z]"
  - Resolves: RHEL-126925


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.7-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/e363f79)
  - fixes "Bump to runc v1.2.9 or v1.3.4 to get CVE and regression fixes - Buildah [rhel-9.7.z]"
  - Resolves: RHEL-132846


author: Jindrich Novy <jnovy@redhat.com> - 2:1.41.8-1
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.41
    (https://github.com/containers/buildah/commit/f85ff89)
  - fixes "CVE-2025-47913 buildah: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-9.7.z]"
  - Resolves: RHEL-134792


author: Zdenek Dohnal <zdohnal@redhat.com> - 1.2.3.3op2-34
changelog:
  - RHEL-112435 CVE-2025-58060 cups: Authentication Bypass in CUPS Authorization Handling
  - RHEL-113078 CVE-2025-58364 cups: Null Pointer Dereference in CUPS ipp_read_io() Leading to Remote DoS


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-34.1
changelog:
  - RHEL-129746 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129738 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Omair Majid <omajid@redhat.com> - 10.0.100~rc.2.25502.107-0.10
changelog:
  - Update to .NET SDK 10.0.100-rc.2.25502.107 and Runtime 10.0.0-rc.2.25502.107
  - Resolves: RHEL-121559


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-1.1
changelog:
  - fix CVE-2025-10920
  - fix CVE-2025-10921
  - fix CVE-2025-10922
  - fix CVE-2025-10923
  - fix CVE-2025-10924
  - fix CVE-2025-10925
  - fix CVE-2025-10934


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.68.4-17
changelog:
  - Add patches for CVE-2024-52533 and CVE-2025-4373
  - Update GDateTime test for new tzdata
  - Resolves: RHEL-94483
  - Resolves: RHEL-102844


author: Joan Torres <joantolo@redhat.com> - 40.10-30
changelog:
  - Fix regression on multiple remote sessions and same user
    Also, add missing fix to keep API/ABI compatibility on GDM greeter proxy.
    Resolves: RHEL-109190


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-17
changelog:
  - Resolves RHEL-125692: CVE-2025-58183
  - Resolves RHEL-120426: Grafana-selinux prevents plugins from searching cgroups


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.1
changelog:
  - Resolves: RHEL-125884 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.2
changelog:
  - Resolves: RHEL-123850 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-7.3
changelog:
  - Resolves: RHEL-135063 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135048 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134480 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Steven Presti <spresti@redhat.com> - 2.23.0-2
changelog:
  - Build Ignition with GOEXPERIMENT=strictfipsruntime
    Ignition-validate non-FIPS
  - Backport https://github.com/coreos/ignition/pull/2159


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22
changelog:
  - Resolves: RHEL-107483 ipa-ca-install fails on CA-less replica due to inadequate key usage in master certificate


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.472.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118767
  - Related: RHEL-119455
  - Related: RHEL-118775


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.9.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Add scripts to handle tagging of portable-based RPMs
  - Related: RHEL-118774
  - Related: RHEL-119466


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Create java-25-openjdk package based on java-21-openjdk
  - Update to jdk-25.0.1+8 (GA)
  - Update release notes with features of JDK 22, 23, 24 & 25
  - Mention finalisation JEP for features finalised in JDK 22, 23 & 24
  - Update release notes to 25.0.1+8
  - Update README file for java-25-openjdk
  - Make sure this is not the default/system JDK providing 'java', 'jre', 'java-devel' ,etc.
  - Remove 21u FIPS patch and disable use until we are ready for the 25 version
  - Adjust CLDR expectations in TestTranslations.java after JDK-8317979 started using tzdata values
  - Adjust TestTranslations.java to expect the same short name throughout for fr_FR and de_DE (bug?)
  - Remove references to libsystemconf.so and nss.fips.cfg from the 21u FIPS patch
  - Include static libraries in the vm_variant subdirectory after JDK-8307858 (libjvm.a)
  - Flip equals test in TestSecurityProperties.java to handle null values from Security.getProperty
  - Introduce crypto_policy_active to designate whether we should expect policy adherence in testing
  - Flip crypto_policy_active to false while the crypto policy & FIPS patch is not present
  - Handle new libsimdsort.so introduced on x86_64 only by JDK-8309130
  - Remove lible.so handling following its removal in JDK-8327476: "Upgrade JLine to 3.26.1"
  - Install jaxp-strict.properties.template added by JDK-8330542: "Template for Creating Strict JAXP Configuration File"
  - alt-java man page installation is now handled by the OpenJDK build
  - Adjust TestTranslations.java with updated German translations from CLDR 46 (JDK-8333582) (Mountain->Mountains)
  - Run javap with the disassembled code (-c) option now required for -l by JDK-8345145
  - Remove default.policy and java.policy following JDK-8338411: "Permanently Disable the Security Manager"
  - Make man page handling dependent on pandoc being available during the portable build
  - Handle new CDS archive variants (*_coh*) added by Compact Object Headers (JDK-8305895)
  - Add missing man page alternatives for jdeprscan, jfr, jhsdb, jimage, jlink & jmod and fix alphabetical ordering
  - Support jnativescan added by JDK-8317611: "Add a tool like jdeprscan to find usage of restricted methods"
  - Add recent native libraries to _privatelibs (libjsvml.so, libsimdsort.so, libsyslookup.so)
  - Support libsleef on AArch64 & RISC-V added by JDK-8329816, JDK-8320500 (RISC-V) & JDK-8312425 (AArch64)
  - Remove superfluous backslashes that cause two alternative commands to be combined
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-126022


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Add libnssadapter.so
  - Add FIPS crypto-policies configuration
  - Remove obsolete security.useSystemPropertiesFile setup
  - Update TestSecurityProperties.java test and calling convention
  - Resolves: RHEL-128414
  - Resolves: RHEL-128412


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-1
changelog:
  - Pass ourflags and ourldflags into the nssadapter build using CFLAGS & LDFLAGS
  - Patch the nssadapter build to recognise LDFLAGS
  - Resolves: RHEL-131898


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.1.0.8-2
changelog:
  - Add java-25-openjdk-crypto-adapter subpackage
  - Update library setting in create-redhat-properties-files.bash
  - Remove /usr/lib/jvm/java-25-openjdk/conf/security/redhat/fips.properties
  - Resolves: RHEL-132520
  - Resolves: RHEL-132523


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.1.0.8-2
changelog:
  - Incorporate new FIPS patch for 25u
  - Drop static libjvm.a following adjusted build target for portable build
  - Remove redundant (and now outdated) build targets, jdkimage and static_libs_image
  - Remove OpenJDK compiler flag filters and use build_{c,ld}flags directly
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-133743
  - Resolves: RHEL-133737
  - Related: RHEL-131898


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.6.1.el9_7]
changelog:
  - pstore/ram: Check start of empty przs during init (CKI Backport Bot) [RHEL-122068] {CVE-2023-53331}
  - ixgbe: fix ixgbe_orom_civd_info struct layout (Michal Schmidt) [RHEL-119074]
  - scsi: lpfc: Fix buffer free/clear order in deferred receive path (CKI Backport Bot) [RHEL-119130] {CVE-2025-39841}
  - efivarfs: Fix slab-out-of-bounds in efivarfs_d_compare (CKI Backport Bot) [RHEL-118257] {CVE-2025-39817}
  - SUNRPC: call xs_sock_process_cmsg for all cmsg (Olga Kornievskaia) [RHEL-110810]
  - sunrpc: fix client side handling of tls alerts (Olga Kornievskaia) [RHEL-110810] {CVE-2025-38571}
  - smb: client: fix wrong index reference in smb2_compound_op() (Paulo Alcantara) [RHEL-117880]
  - smb: client: handle unlink(2) of files open by different clients (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix file open check in __cifs_unlink() (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix filename matching of deferred files (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix data loss due to broken rename(2) (Paulo Alcantara) [RHEL-117880]
  - smb: client: fix compound alignment with encryption (Paulo Alcantara) [RHEL-117880]
  - fs/smb: Fix inconsistent refcnt update (Paulo Alcantara) [RHEL-117880] {CVE-2025-39819}
  - sunrpc: fix handling of server side tls alerts (Steve Dickson) [RHEL-111069] {CVE-2025-38566}
  - wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() (CKI Backport Bot) [RHEL-117580] {CVE-2025-39849}
  - crypto: seqiv - Handle EBUSY correctly (CKI Backport Bot) [RHEL-117235] {CVE-2023-53373}
  - ibmvnic: Increase max subcrq indirect entries with fallback (Mamatha Inamdar) [RHEL-116187]
  - fs: fix UAF/GPF bug in nilfs_mdt_destroy (CKI Backport Bot) [RHEL-116662] {CVE-2022-50367}
  - firmware: arm_scpi: Ensure scpi_info is not assigned if the probe fails (Charles Mirabile) [RHEL-113837] {CVE-2022-50087}
  - hv_netvsc: Fix panic during namespace deletion with VF (Maxim Levitsky) [RHEL-115070]
  - RDMA/mana_ib: Fix DSCP value in modify QP (Maxim Levitsky) [RHEL-115070]
  - net: mana: Handle Reset Request from MANA NIC (Maxim Levitsky) [RHEL-115070]
  - net: mana: Set tx_packets to post gso processing packet count (Maxim Levitsky) [RHEL-115070]
  - net: mana: Handle unsupported HWC commands (Maxim Levitsky) [RHEL-115070]
  - net: mana: Add handler for hardware servicing events (Maxim Levitsky) [RHEL-115070]
  - RDMA/mana_ib: Add device statistics support (Maxim Levitsky) [RHEL-115070]
  - net: mana: Expose additional hardware counters for drop and TC via ethtool. (Maxim Levitsky) [RHEL-115070]
  - net: mana: Fix warnings for missing export.h header inclusion (Maxim Levitsky) [RHEL-115070]
  - net: mana: Record doorbell physical address in PF mode (Maxim Levitsky) [RHEL-115070]
  - s390/pci: Do not try re-enabling load/store if device is disabled (CKI Backport Bot) [RHEL-114451]
  - s390/pci: Fix stale function handles in error handling (CKI Backport Bot) [RHEL-114451]
  - redhat: enable TDX host config (Paolo Bonzini) [RHEL-27146]
  - KVM: TDX: Explicitly do WBINVD when no more TDX SEAMCALLs (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Update the kexec section in the TDX documentation (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Remove the !KEXEC_CORE dependency (Paolo Bonzini) [RHEL-27146]
  - x86/kexec: Disable kexec/kdump on platforms with TDX partial write erratum (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Mark memory cache state incoherent when making SEAMCALL (Paolo Bonzini) [RHEL-27146]
  - x86/sme: Use percpu boolean to control WBINVD during kexec (Paolo Bonzini) [RHEL-27146]
  - x86/virt/tdx: Avoid indirect calls to TDX assembly functions (Paolo Bonzini) [RHEL-27146]
  - ibmvnic: Use ndo_get_stats64 to fix inaccurate SAR reporting (Mamatha Inamdar) [RHEL-114437]
  - ibmvnic: Fix hardcoded NUM_RX_STATS/NUM_TX_STATS with dynamic sizeof (Mamatha Inamdar) [RHEL-114437]
  - ibmvnic: Add stat for tx direct vs tx batched (Mamatha Inamdar) [RHEL-114437]
  - redhat/configs: Enable CONFIG_MITIGATION_VMSCAPE for x86 (Waiman Long) [RHEL-114272]
  - x86/vmscape: Add old Intel CPUs to affected list (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Warn when STIBP is disabled with SMT (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/bugs: Move cpu_bugs_smt_update() down (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Enable the mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Add conditional IBPB mitigation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - x86/vmscape: Enumerate VMSCAPE bug (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - Documentation/hw-vuln: Add VMSCAPE documentation (Waiman Long) [RHEL-114272] {CVE-2025-40300}
  - randomize_kstack: Remove non-functional per-arch entropy filtering (Waiman Long) [RHEL-114272]
  - tunnels: reset the GSO metadata before reusing the skb (Antoine Tenart) [RHEL-113917]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.7.1.el9_7]
changelog:
  - The rpminspect.yaml emptyrpm list needs to be expanded (Alexandra Hájková)
  - crypto: xts - Handle EBUSY correctly (Vladis Dronov) [RHEL-119236] {CVE-2023-53494}
  - ice: fix NULL access of tx->in_use in ice_ll_ts_intr (Petr Oros) [RHEL-112874]
  - ice: fix NULL access of tx->in_use in ice_ptp_ts_irq (Petr Oros) [RHEL-112874]
  - ice: fix Rx page leak on multi-buffer frames (Petr Oros) [RHEL-116540]
  - xfs: do not propagate ENODATA disk errors into xattr code (Carlos Maiolino) [RHEL-115730]
  - ipv6: sr: Fix MAC comparison to be constant-time (CKI Backport Bot) [RHEL-116383] {CVE-2025-39702}
  - s390/hypfs: Enable limited access during lockdown (CKI Backport Bot) [RHEL-114434]
  - s390/hypfs: Avoid unnecessary ioctl registration in debugfs (CKI Backport Bot) [RHEL-114434]
  - vsock/virtio: Validate length in packet header before skb_put() (Jon Maloy) [RHEL-114298] {CVE-2025-39718}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.8.1.el9_7]
changelog:
  - NFSD: Fix callback decoder status codes (Jay Shin) [RHEL-127193]
  - NFSD: Fix CB_GETATTR status fix (Jay Shin) [RHEL-127193]
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Jay Shin) [RHEL-127193]
  - kernfs: Fix UAF in polling when open file is released (Pavel Reichl) [RHEL-122087] {CVE-2025-39881}
  - gitlab-ci: disable automotive pipelines (Scott Weaver)
  - NFS: Fix wakeup of __nfs_lookup_revalidate() in unblock_revalidate() (Benjamin Coddington) [RHEL-122154]
  - sched: Add wait/wake interface for variable updated under a lock. (Benjamin Coddington) [RHEL-122154]
  - sched: Add test_and_clear_wake_up_bit() and atomic_dec_and_wake_up() (Benjamin Coddington) [RHEL-122154]
  - sched: Document wait_var_event() family of functions and wake_up_var() (Benjamin Coddington) [RHEL-122154]
  - sched: Improve documentation for wake_up_bit/wait_on_bit family of functions (Benjamin Coddington) [RHEL-122154]
  - sched: change wake_up_bit() and related function to expect unsigned long * (Benjamin Coddington) [RHEL-122154]
  - bpf: Fix metadata_dst leak __bpf_redirect_neigh_v{4,6} [rhel-9.7.z] (Xin Long) [RHEL-125513]
  - redhat: use the same cert as UKI's to sign addons (Li Tian) [RHEL-125317]
  - i40e: add mask to apply valid bits for itr_idx (Michal Schmidt) [RHEL-123808]
  - i40e: add max boundary check for VF filters (Michal Schmidt) [RHEL-123808] {CVE-2025-39968}
  - i40e: fix validation of VF state in get resources (Michal Schmidt) [RHEL-123808] {CVE-2025-39969}
  - i40e: fix input validation logic for action_meta (Michal Schmidt) [RHEL-123808] {CVE-2025-39970}
  - i40e: fix idx validation in config queues msg (Michal Schmidt) [RHEL-123808] {CVE-2025-39971}
  - i40e: fix idx validation in i40e_validate_queue_map (Michal Schmidt) [RHEL-123808] {CVE-2025-39972}
  - i40e: add validation for ring_len param (Michal Schmidt) [RHEL-123808] {CVE-2025-39973}
  - io_uring/waitid: always prune wait queue entry in io_waitid_wait() (CKI Backport Bot) [RHEL-124971] {CVE-2025-40047}
  - Bluetooth: hci_event: Fix UAF in hci_conn_tx_dequeue (CKI Backport Bot) [RHEL-124129] {CVE-2025-39983}
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123821] {CVE-2025-39982}
  - use uniform permission checks for all mount propagation changes (Ian Kent) [RHEL-121704] {CVE-2025-38498}
  - do_change_type(): refuse to operate on unmounted/not ours mounts (Ian Kent) [RHEL-121704] {CVE-2025-38498}
  - KVM: x86/hyper-v: Skip non-canonical addresses during PV TLB flush (Jon Maloy) [RHEL-117136] {CVE-2025-38351}
  - ibmveth: Add multi buffers rx replenishment hcall support (Mamatha Inamdar) [RHEL-117438]
  - net: ibmveth: Reset the adapter when unexpected states are detected (Mamatha Inamdar) [RHEL-117438]
  - NFS: Fix a race when updating an existing write (CKI Backport Bot) [RHEL-113855] {CVE-2025-39697}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.9.1.el9_7]
changelog:
  - NFSv4: handle ERR_GRACE on delegation recalls (Olga Kornievskaia) [RHEL-124651]
  - nfsd: nfserr_jukebox in nlm_fopen should lead to a retry (Olga Kornievskaia) [RHEL-124651]
  - mm: slub: avoid wake up kswapd in set_track_prepare (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
  - slub: Reflow ___slab_alloc() (Audra Mitchell) [RHEL-125521] {CVE-2025-39843}
  - nvme-multipath: Skip nr_active increments in RETRY disposition (Ewan D. Milne) [RHEL-123686]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.10.1.el9_7]
changelog:
  - ice: ice_adapter: release xa entry on adapter allocation failure (CKI Backport Bot) [RHEL-128469] {CVE-2025-40185}
  - iommu/vt-d: Disallow dirty tracking if incoherent page walk (Eder Zulian) [RHEL-125478] {CVE-2025-40058}
  - e1000e: fix heap overflow in e1000_set_eeprom (Corinna Vinschen) [RHEL-123111] {CVE-2025-39898}
  - nfsd: handle get_client_locked() failure in nfsd4_setclientid_confirm() (CKI Backport Bot) [RHEL-125604] {CVE-2025-38724}
  - wifi: cfg80211: fix use-after-free in cmp_bss() (CKI Backport Bot) [RHEL-122874] {CVE-2025-39864}
  - platform/x86/intel: power-domains: Use topology_logical_package_id() for package ID (Jay Shin) [RHEL-116680]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.11.1.el9_7]
changelog:
  - tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request(). (Antoine Tenart) [RHEL-120668]
  - tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect(). (Antoine Tenart) [RHEL-120668] {CVE-2025-39955}
  - Bluetooth: MGMT: fix crash in set_mesh_sync and set_mesh_complete (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix sparse errors (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix possible UAFs (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: hci_sync: fix set_local_name race condition (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: set_mesh: update LE scan interval and window (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Protect mgmt_pending list with its own lock (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - Bluetooth: MGMT: Fix UAF on mgmt_remove_adv_monitor_complete (CKI Backport Bot) [RHEL-122892] {CVE-2025-39981}
  - wifi: mt76: free pending offchannel tx frames on wcid cleanup (Jose Ignacio Tornos Martinez) [RHEL-123064]
  - wifi: mt76: do not add non-sta wcid entries to the poll list (Jose Ignacio Tornos Martinez) [RHEL-123064]
  - wifi: mt76: fix linked list corruption (Jose Ignacio Tornos Martinez) [RHEL-123064] {CVE-2025-39918}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.12.1.el9_7]
changelog:
  - x86/hyperv: Fix kdump on Azure CVMs (Li Tian) [RHEL-129776]
  - net/mlx5: fs, fix UAF in flow counter release (Michal Schmidt) [RHEL-124428] {CVE-2025-39979}
  - octeon_ep: Validate the VF ID (Kamal Heib) [RHEL-117604]
  - dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Increase maximum size of flash utility (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Fix double free in zl3073x_devlink_flash_update() (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Implement devlink flash callback (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add firmware loading functionality (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add low-level flash functions (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Add functions to access hardware registers (Ivan Vecera) [RHEL-116162]
  - dpll: zl3073x: Handle missing or corrupted flash configuration (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Refactor DPLL initialization (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: ZL3073X_I2C and ZL3073X_SPI should depend on NET (Ivan Vecera) [RHEL-113083]
  - dpll: Make ZL3073X invisible (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Fix build failure (Ivan Vecera) [RHEL-113083]
  - redhat/configs: enable CONFIG_ZL3073X* (Ivan Vecera) [RHEL-113083]
  - redhat/configs: enable CONFIG_I2C_MUX_PCA954x on x86 (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get fractional frequency offset (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to adjust phase (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement phase offset monitor feature (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get phase offset on connected input pin (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set esync on pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set frequency on pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement input pin state setting in automatic mode (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Add support to get/set priority on input pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Implement input pin selection in manual mode (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Register DPLL devices and pins (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Read DPLL types and pin properties from system firmware (Ivan Vecera) [RHEL-113083]
  - dpll: zl3073x: Fetch invariants during probe (Ivan Vecera) [RHEL-113083]
  - dpll: Add basic Microchip ZL3073x support (Ivan Vecera) [RHEL-113083]
  - spi: Introduce spi_get_device_match_data() helper (Ivan Vecera) [RHEL-113083]
  - dt-bindings: dpll: Add support for Microchip Azurite chip family (Ivan Vecera) [RHEL-113083]
  - dt-bindings: dpll: Add DPLL device and pin (Ivan Vecera) [RHEL-113083]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.13.1.el9_7]
changelog:
  - can: j1939: add missing calls in NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124105] {CVE-2025-39925}
  - can: j1939: implement NETDEV_UNREGISTER notification handler (CKI Backport Bot) [RHEL-124105] {CVE-2025-39925}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.15.1.el9_7]
changelog:
  - nbd: override creds to kernel when calling sock_{send,recv}msg() (Ming Lei) [RHEL-123845]
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-127982]
  - scsi: lpfc: Fix reusing an ndlp that is marked NLP_DROPPED during FLOGI (Ewan D. Milne) [RHEL-127982]
  - crypto: ccp - Always pass in an error pointer to __sev_platform_shutdown_locked() (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix SNP panic notifier unregistration (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix dereferencing uninitialized error pointer (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Fix __sev_snp_shutdown_locked (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Move SEV/SNP Platform initialization to KVM (Lenny Szubowicz) [RHEL-70006]
  - KVM: SVM: Add support to initialize SEV/SNP functionality in KVM (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Add new SEV/SNP platform shutdown API (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Register SNP panic notifier only if SNP is enabled (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Reset TMR size at SNP Shutdown (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Ensure implicit SEV/SNP init and shutdown in ioctls (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Move dev_info/err messages for SEV/SNP init and shutdown (Lenny Szubowicz) [RHEL-70006]
  - crypto: ccp - Abort doing SEV INIT if SNP INIT fails (Lenny Szubowicz) [RHEL-70006]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.16.1.el9_7]
changelog:
  - CVE-2025-38499 kernel: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns (Abhi Das) [RHEL-129261] {CVE-2025-38499}
  - tls: wait for pending async decryptions if tls_strp_msg_hold fails (CKI Backport Bot) [RHEL-128860] {CVE-2025-40176}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.17.1.el9_7]
changelog:
  - smb: client: handle lack of IPC in dfs_cache_refresh() (Paulo Alcantara) [RHEL-126165]
  - smb: client: get rid of d_drop() in cifs_do_rename() (Paulo Alcantara) [RHEL-124917]
  - mm/memory-failure: fix VM_BUG_ON_PAGE(PagePoisoned(page)) when unpoison memory (CKI Backport Bot) [RHEL-119150] {CVE-2025-39883}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.18.1.el9_7]
changelog:
  - NFS: remove revoked delegation from server's delegation list (Benjamin Coddington) [RHEL-134237]
  - redhat: use RELEASE_LOCALVERSION also for dist-get-tag (Jan Stancek)
  - redhat: introduce RELEASE_LOCALVERSION variable (Jan Stancek)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.19.1.el9_7]
changelog:
  - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-133543]
  - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-133543]
  - audit: fix out-of-bounds read in audit_compare_dname_path() (Richard Guy Briggs) [RHEL-119176] {CVE-2025-39840}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.20.1.el9_7]
changelog:
  - HID: multitouch: fix slab out-of-bounds access in mt_report_fixup() (CKI Backport Bot) [RHEL-124607] {CVE-2025-39806}
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI Backport Bot) [RHEL-134001] {CVE-2025-40240}
  - selftests/landlock: Add a new test for setuid() (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Split signal_scoping_threads tests (Štěpán Horáček) [RHEL-132712]
  - landlock: Always allow signals between threads of the same process (Štěpán Horáček) [RHEL-132712]
  - landlock: Prepare to add second errata (Štěpán Horáček) [RHEL-132712]
  - landlock: Add the errata interface (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Test signal scoping for threads (Štěpán Horáček) [RHEL-132712]
  - selftests/landlock: Test signal scoping (Štěpán Horáček) [RHEL-132712]
  - landlock: Add signal scoping (Štěpán Horáček) [RHEL-132712]


author: Tomas Halman <thalman@redhat.com - 2.9.7.4.1
changelog:
  - Resolves: RHEL-120298 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation
    on AD-joined Linux systems


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.1
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131580)
  - CVE-2025-65018: heap buffer overflow (RHEL-131593)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133287)


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-11
changelog:
  - Backport patches for various CVEs, plus test improvements
    Resolves: RHEL-85909
    Resolves: RHEL-85915
    Resolves: RHEL-85920
    Resolves: RHEL-87058
    Resolves: RHEL-87068
    Resolves: RHEL-87101
    Resolves: RHEL-87119
    Resolves: RHEL-88360
    Resolves: RHEL-88363


author: Michael Catanzaro <mcatanzaro@redhat.com> - 2.72.0-12
changelog:
  - Backport patches for various CVEs
    Resolves: RHEL-84797
    Resolves: RHEL-85888
    Resolves: RHEL-87080
    Resolves: RHEL-92284


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-16
changelog:
  - Fix CVE-2025-5987
    Resolves: RHEL-130051
  - Workaround sshd failure rate limiting in tests
    Resolves: RHEL-135506


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.1.el9_7
changelog:
  - tools: Secure guest check for Intel in virt-host-validate (RHEL-111840)
  - qemu: Check if INTEL Trust Domain Extention support is enabled (RHEL-111840)
  - qemucapabilitiesdata: Document '+inteltdx' variant (RHEL-111840)
  - qemucapabilitiestest: Add data for the qemu-10.1.0 dev cycle on x86_64 for the '+inteltdx' variant (RHEL-111840)
  - qemu: Add QEMU_CAPS_TDX_GUEST capability (RHEL-111840)
  - conf: Expose TDX feature in domain capabilities (RHEL-111840)
  - conf: Add tdx as launch security type (RHEL-111840)
  - conf: Validate TDX launchSecurity element mrConfigId/mrOwner/mrOwnerConfig (RHEL-111840)
  - qemu: Add command line and validation for TDX type (RHEL-111840)
  - conf: Expose TDX type in domain launch security capability (RHEL-111840)
  - qemu: Force special parameters enabled for TDX guest (RHEL-111840)
  - qemu: log the crash information for TDX (RHEL-111840)
  - qemu_firmware: Pick the right firmware for TDX guests (RHEL-111840)
  - conf: Add Intel TDX Quote Generation Service(QGS) support (RHEL-111840)
  - qemu: Add command line for TDX Quote Generation Service(QGS) (RHEL-111840)
  - qemu: Add FakeReboot support for TDX guest (RHEL-111840)
  - qemu: Support reboot command in guest (RHEL-111840)
  - qemu: Avoid duplicate FakeReboot for secure guest (RHEL-111840)
  - qemu: Send event VIR_DOMAIN_EVENT_[STOPPED|STARTED] during recreation (RHEL-111840)
  - qemu: Support domain reset command for TDX guest (RHEL-111840)
  - qemuxmlconftest: Add latest version of 'launch-security-tdx*' test data (RHEL-111840)
  - docs: domain: Add documentation for Intel TDX guest (RHEL-111840)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.2.el9_7
changelog:
  - virBitmapFormat: Don't check return value (RHEL-122930)
  - domain_conf: Make virDomainMemoryDefFormat() return void (RHEL-122930)
  - domain_conf: Switch to virXMLFormatElement() in virDomainMemoryDefFormat() (RHEL-122930)
  - conf: Introduce virDomainMemoryIsVirtioModel() (RHEL-122930)
  - qemu: Use virDomainMemoryIsVirtioModel() (RHEL-122930)
  - conf: Introduce virtio options for virtio memory models (RHEL-122930)
  - qemu_command: Generate virtio options for memory device (RHEL-122930)
  - domain_conf: Avoid memory leak in virDomainMemoryDefFree() (RHEL-122930)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.3.el9_7
changelog:
  - conf: Do not parse hyperv features with passthrough mode (RHEL-122930)
  - src: Drop needless typecast to virDomainTimerNameType (RHEL-122930)
  - conf: Introduce virDomainDefHasTimer() (RHEL-122930)
  - qemuxmlconfdata: Adjust hv-stimer related tests (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-synic (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-stimer (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-tlbflush (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-ipi (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-evmcs (RHEL-122930)
  - qemu_validate: Reflect dependencies of hv-tlbflush-direct (RHEL-122930)
  - virxml: Introduce virXPathTristateSwitch() (RHEL-122930)
  - virxml: Introduce virXPathTristateBool() (RHEL-122930)
  - qemu: Use virXPathTristateBool() (RHEL-122930)
  - domain_conf: Move format of hyperv features into a function (RHEL-122930)
  - domain_conf: Use virXMLFormatElement() to format hyperv features (RHEL-122930)
  - qemu_caps: Prefer VIR_DOMAIN_CAPS_ENUM_IS_SET() (RHEL-122930)
  - qemu_command: Move hyperv cmd line generation into a function (RHEL-122930)
  - qemu_command: Prefer virBufferAddLit() in qemuBuildCpuHypervCommandLine() (RHEL-122930)
  - conf: More hyperv related members into a single struct (RHEL-122930)
  - conf: Report default hyperv values in domain capabilities (RHEL-122930)
  - qemu_capabilities: Format and parse new hyperv domcaps members (RHEL-122930)
  - qemu_capabilities: Fetch new hyperv domcaps (RHEL-122930)
  - qemu_caps: Introduce virQEMUCapsGetHypervCapabilities() (RHEL-122930)
  - conf: Introduce hyperv host-model mode (RHEL-122930)
  - qemu_process: Populate hyperv features for host-model (RHEL-122930)
  - RHEL: Remove patches from invalid 10.10.0-15.2.el9_7 build (RHEL-122930)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.4.el9_7
changelog:
  - cpu_conf: Make virCPUDefFilterFeatures return void (RHEL-126096)
  - qemu_domain: Simplify qemuDomainFixupCPUs (RHEL-126096)
  - qemu_domain: Fix qemuDomainFixupCPUs (RHEL-126096)
  - qemu_process: Always fix CPUs on reconnect (RHEL-126096)
  - qemu_monitor: Filter CPU features reported by QEMU (RHEL-126096)
  - qemu: Ignore "ht" CPU feature (RHEL-126096)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.12.1-6
changelog:
  - Add stylus definitions for the propen group (RHEL-122207)
  - Add tablet definitions for the latest Cintiqs (RHEL-122206)
  - Fix the overlap for button assignments in the SVG (RHEL-126355)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:2.4.26-1.1
changelog:
  - Resolves: RHEL-134496 - httpd: Apache HTTP Server: mod_md (ACME), unintended
    retry intervals (CVE-2025-55753)


author: Gris Ge <fge@redhat.com> - 2.2.52-1
changelog:
  - Upgrade to 2.2.52
  - Support IPSec `leftsendcert` option. RHEL-110634
  - Support interface alternative names. RHEL-110778


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Support matching interface via PCI address. RHEL-121110
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121991


author: Andrei Radchenko <aradchen@redhat.com> - 1:22.13.1-2
changelog:
  - Remove obsolete lua pretransaction script from spec file
    Resolves: RHEL-81119
  - Disable npm update notifications for users
    Resolves: RHEL-81079


author: Matthew Burket <mburket@redhat.com> - 1:1.3.13-1
changelog:
  - Upgrade to the latest upstream release (RHEL-133976)
  - Fix Filepath and Pattern Fields inversion (RHEL-104073)
  - Fix verbose flag (RHEL-53859)


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-47
changelog:
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-128401
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-128392


author: Remi Collet <rcollet@redhat.com> - 8.0.30-4
changelog:
  - Fix pgsql extension does not check for errors during escaping
    CVE-2025-1735
  - Fix NULL Pointer Dereference in PHP SOAP Extension via Large XML Namespace Prefix
    CVE-2025-6491
  - Fix Null byte termination in hostnames
    CVE-2025-1220
  - Fix soap memory corruption
  - Fix ldap_set_option() not applied on different ldap connections


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/7078b79)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [rhel-9.7]"
  - Resolves: RHEL-113151


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/c5a3735)
  - fixes "Can not find network create and rm message from podman event when set --events-backend to journald - [RHEL 9.7] 0day"
  - Resolves: RHEL-110317


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/61231e1)
  - fixes "Timeouts while pushing Sigstore logs to Rekor - [RHEL 9.7] 0day"
  - Resolves: RHEL-111076


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/2791007)
  - fixes "[Minor Incident] CVE-2025-52881 podman: container escape and denial of service due to arbitrary write gadgets and procfs write redirects [rhel-9.7.z]"
  - Resolves: RHEL-126913


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/3bf5313)
  - fixes "run 1.2.x upgrade throws error while using nocopy volume mount filesystem option - [RHEL 9.7]"
  - Resolves: RHEL-132531


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-29.el9_7.1
changelog:
  - kvm-arm-kvm-report-registers-we-failed-to-set.patch [RHEL-120502]
  - Resolves: RHEL-120502
    ([rhel9] Backport "arm/kvm: report registers we failed to set" [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-29.el9_7.2
changelog:
  - kvm-io-move-websock-resource-release-to-close-method.patch [RHEL-120125]
  - kvm-io-fix-use-after-free-in-websocket-handshake-code.patch [RHEL-120125]
  - Resolves: RHEL-120125
    (CVE-2025-11234 qemu-kvm: VNC WebSocket handshake use-after-free [rhel-9.7.z])


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-2
changelog:
  - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup
    Resolves: RHEL-104999
  - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices
    Resolves: RHEL-105004


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-5
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-127912
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-122015


author: Jindrich Novy <jnovy@redhat.com> - 4:1.3.0-2
changelog:
  - fix CVE-2025-31133 CVE-2025-52565 CVE-2025-52881
  - Resolves: RHEL-122400
  - Resolves: RHEL-122403
  - Resolves: RHEL-122414


author: Dan Horák <dhorak@redhat.com> - 2:2.38.0-2.1
changelog:
  - libekmfweb: Fix generation of certificate or CSR with RSA-PSS instead of RSA (RHEL-115828)
  - chpstat: Fix scaling of DPU utilization calculation (RHEL-115843)
  - Resolves: RHEL-115828 RHEL-115843


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-22.1
changelog:
  - Resolves: RHEL-122492 - squid: Squid vulnerable to information disclosure via
    authentication credential leakage in error handling (CVE-2025-62168)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-22.2
changelog:
  - Resolves: RHEL-131797 - "ICAP_ERR_OTHER/408" occurs in icap.log when
    downloading a file on RHEL9


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.1
changelog:
  - meson: /etc/systemd/network is also used by udevd (RHEL-111611)
  - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-110954)
  - test-time-util: disable failing tests (RHEL-110954)
  - test: test parse_timestamp() in various timezone (RHEL-110954)
  - systemctl: logind: add missing asserts (RHEL-110954)
  - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-110954)
  - systemctl: add option --when for scheduled shutdown (RHEL-110954)
  - test-time-util: add test cases to invalidate "show" and "cancel" (RHEL-110954)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-111630)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-111630)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-111630)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-111630)
  - core: do not disconnect from bus when failed to install signal match (RHEL-111630)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-111630)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-111630)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-111630)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-111630)
  - core/manager: drop duplicate bus track deserialization (RHEL-111630)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-111630)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.2
changelog:
  - Revert "test-time-util: disable failing tests" (RHEL-110954)
  - test: use get_timezones() to iterate all known timezones (RHEL-110954)
  - test-time-util: do not fail on DST change (RHEL-110954)
  - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-110954)
  - test-time-util: do more suppression of time zone checks (RHEL-110954)
  - test-time-util: fix truncation of usec to sec (RHEL-110954)
  - test: unset TZ before timezone-sensitive unit tests are run (RHEL-110954)
  - meson: extend timeout for test-time-util (RHEL-110954)
  - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-110954)
  - time-util: align string table (RHEL-110954)
  - time-util: rename variables (RHEL-110954)
  - time-util: add assertions (RHEL-110954)
  - time-util: drop redundant else (RHEL-110954)
  - time-util: do not use strdupa() (RHEL-110954)
  - time-util: use result from startswith_no_case() (RHEL-110954)
  - time-util: use usec_add() and usec_sub_unsigned() (RHEL-110954)
  - time-util: shorten code a bit (RHEL-110954)
  - time-util: rename variables (RHEL-110954)
  - time-util: drop unnecessary assignment of timezone name (RHEL-110954)
  - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-110954)
  - time-util: fix typo (RHEL-110954)
  - ci: bump the tools tree to F42 (RHEL-110954)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.4
changelog:
  - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-118294)
  - cryptsetup: fix typo (RHEL-118294)
  - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-118294)
  - basic: add PIDFS magic (#31709) (RHEL-118294)
  - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-118294)
  - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138)
  - coredump: restore compatibility with older patterns (RHEL-104138)
  - coredump: use %d in kernel core pattern (RHEL-104138)
  - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138)
  - fd-util: introduce parse_fd() (RHEL-104138)
  - coredump: add support for new %F PIDFD specifier (RHEL-104138)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.5
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-127022)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-127022)
  - test: check the next elapse timer timestamp after deserialization (RHEL-127022)
  - timer: don't run service immediately after restart of a timer (RHEL-127022)
  - test: store and compare just the property value (RHEL-127022)
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-127022)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-126114)


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119986

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120007

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120768


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-23
changelog:
  - RHEL-112005 CVE-2025-53905 vim: Vim path traversial
  - RHEL-112009 CVE-2025-53906 vim: Vim path traversal


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119960), CVE-2025-62230 (RHEL-120033),
                 CVE-2025-62231 (RHEL-125002)


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119974), CVE-2025-62230 (RHEL-120021),
                 CVE-2025-62231 (RHEL-125017)


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-8
changelog:
  - Resolves: RHEL-111228 - Error showing local password policy on web UI [rhel-9.7.z]
  - Resolves: RHEL-117049 - Replication online reinitialization of a large database gets stalled. [rhel-9.7.z]
  - Resolves: RHEL-117770 - When the server restarts after a crash, the RFE assumes memberof should be recomputed. It triggers a memberof fixup task, dirsrv became unresponsive. [rhel-9.7.z]
  - Resolves: RHEL-123230 - Improve the way to detect asynchronous operations in the access logs [rhel-9.7.z]
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123257 - Typo in errors log after a Memberof fixup task. [rhel-9.7.z]
  - Resolves: RHEL-123278 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9.7.z]
  - Resolves: RHEL-123367 - IPA health check up script shows time skew is over 24 hours [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-123852 - Units for changing MDB max size are not consistent across different tools [rhel-9.7.z]
  - Resolves: RHEL-123892 - Improve output dsctl dbverify when backend does not exist [rhel-9.7.z]
  - Resolves: RHEL-123896 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9.7.z]
  - Resolves: RHEL-123922 - Changelog trimming - add number of scanned entries to the log [rhel-9.7.z]
  - Resolves: RHEL-126551 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly [rhel-9.7.z]
  - Resolves: RHEL-129558 - Online initialization of consumers fails with error -23 [rhel-9.7.z]
  - Resolves: RHEL-129579 - Fix paged result search locking [rhel-9.7.z]
  - Resolves: RHEL-138480 - Memory leak observed in ns-slapd with 389-ds-base-2.6.1-12 [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-140274 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-9
changelog:
  - Resolves: RHEL-116425 - RetroCL plugin generates invalid LDIF [rhel-9.7.z]
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-123896 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9.7.z]
  - Resolves: RHEL-129558 - Online initialization of consumers fails with error -23 [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-142979 - Scalability issue of replication online initialization with large database [rhel-9.7.z]
  - Resolves: RHEL-146898 - memory corruption in alias entry plugin [rhel-9.7.z]
  - Resolves: RHEL-147211 - Access logs are not getting deleted as configured. [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-10
changelog:
  - Resolves: RHEL-123243 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9.7.z]
  - Resolves: RHEL-123765 - 389-ds-base OpenScanHub Leaks Detected [rhel-9.7.z]
  - Resolves: RHEL-137083 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.7.z]
  - Resolves: RHEL-140088 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9.7.z]
  - Resolves: RHEL-150906 - Remove memberof_del_dn_from_groups from MemberOf plugin [rhel-9.7.z]


author: Viktor Ashirov <vashirov@redhat.com> - 2.7.0-12
changelog:
  - Resolves: RHEL-153553 - 389-ds-base-2.7.0-10.el9_7 updates dse.ldif with lowercase DNs causing ipa-healthcheck errors


author: Jon Maloy <jmaloy@redhat.com> - 4.0.2-11
changelog:
  - Fix CVE-2025-68114 (memory corruption) and CVE-2025-67873 (heap buffer overflow)
    Resolves: RHEL-137758


author: Petr Hybl <phybl@redhat.com> - 1:1.1.1k-5.2
changelog:
  - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
    Resolves: RHEL-142722


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.4
changelog:
  - bundled urllib3: fix CVE-2025-66471
  - bundled urllib3: fix CVE-2026-21441
    Resolves: RHEL-139793, RHEL-140795


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.10
changelog:
  - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471,
    CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs
    Resolves: RHEL-146351


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.1
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142426, RHEL-142410, RHEL-142394, RHEL-142378, RHEL-142362,
    Resolves: RHEL-142346, RHEL-142330


author: Jindrich Novy <jnovy@redhat.com> - 1.16-1
changelog:
  - update to https://github.com/containers/fuse-overlayfs/releases/tag/v1.16
  - fixes "Update fuse-overlayfs to 1.16 [rhel-9.7.z]"
  - Resolves: RHEL-128520


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.3-10
changelog:
  - Fix PKCS#11 token initialization label overflow (CVE-2025-9820)
  - Fix name constraint processing performance issue (CVE-2025-14831)


author: Miroslav Lichvar <mlichvar@redhat.com> - 1:3.26.1-1.el9_7.1
changelog:
  - fix buffer overflow in NMEA2000 driver (CVE-2025-67268)
  - fix integer underflow in handling of Navcom packets (CVE-2025-67269)


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-17
changelog:
  - Resolves RHEL-144959: CVE-2026-21721
  - Resolves RHEL-146863: CVE-2025-61726
  - Resolves RHEL-147081: CVE-2025-61729
  - Resolves RHEL-147370: CVE-2025-61728
  - Resolves RHEL-149621: CVE-2025-68121


author: Sam Feifer <sfeifer@redhat.com> - 5.1.1-12
changelog:
  - Resolves RHEL-146864: CVE-2025-61726
  - Resolves RHEL-147082: CVE-2025-61729
  - Resolves RHEL-149622: CVE-2025-68121


author: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> - 31-3
changelog:
  - Rebuilt to fix: 
    - CVE-2025-61726
    - CVE-2025-61729
    - CVE-2025-68121
    - RHEL-146867
    - RHEL-147085
    - RHEL-149625


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-22.2
changelog:
  - Resolves: RHEL-141322 Memory leaks in IPA plugins
  - Resolves: RHEL-141314 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-129963 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-124424 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-1
changelog:
  - Update to 8u482-b08 (GA).
  - Update release notes for 8u482-b08.
  - Remove generated-configure.sh changes from JDK-8141590 & FIPS patch as we already autogenerate this
  - Turn on system FreeType as on later JDK versions and add to _privatelibs
  - Set bundled FreeType version to 2.13.2 following JDK-8316028
  - Bump LCMS 2 version to 2.14.0 following JDK-8297088
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-142687
  - Resolves: RHEL-139534
  - Resolves: RHEL-131588
  - Resolves: RHEL-131600
  - Resolves: RHEL-142875
  - Resolves: RHEL-142697


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.18+7 (EA)
  - Add to .gitignore openjdk-17.0.18+7-ea.tar.xz
  - Set updatever to 18
  - Set buildver to 7
  - Set is_ga to 0
  - Update sources to openjdk-17.0.18+7-ea.tar.xz
  - Set bundled libpng version to 1.6.51
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-1
changelog:
  - Update to jdk-17.0.18+8 (GA)
  - Add to .gitignore openjdk-17.0.18+8.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set buildver to 8
  - Set is_ga to 1
  - Update sources to openjdk-17.0.18+8.tar.xz
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-1
changelog:
  - Update to jdk-21.0.10+7 (GA)
  - Update release notes to 21.0.10+7
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Update FIPS patch to include nss.fips.cfg that grants CKA_ENCRYPT
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-142859
  - Resolves: RHEL-139560
  - Resolves: RHEL-131592
  - Resolves: RHEL-131602
  - Resolves: RHEL-122121
  - Resolves: RHEL-142820
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139577
  - Resolves: RHEL-142856
  - Resolves: RHEL-142808


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.21.1.el9_7]
changelog:
  - usb: dwc3: Fix race condition between concurrent dwc3_remove_requests() call paths (CKI Backport Bot) [RHEL-137147] {CVE-2025-68287}
  - redhat: conflict with unsupported shim on x86/aarch64 (9.7.z) (Li Tian) [RHEL-135775]
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134428] {CVE-2025-40277}
  - perf tools: Don't set attr.exclude_guest by default (Michael Petlan) [RHEL-131726]
  - smb: client: fix refcount leak in smb2_set_path_attr (Paulo Alcantara) [RHEL-127422]
  - smb: client: fix potential UAF in smb2_close_cached_fid() (Paulo Alcantara) [RHEL-127422]
  - smb: client: fix potential cfid UAF in smb2_query_info_compound (Paulo Alcantara) [RHEL-127422]
  - smb: client: Fix refcount leak for cifs_sb_tlink (Paulo Alcantara) [RHEL-127422]
  - cifs: parse_dfs_referrals: prevent oob on malformed input (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove cfids_invalidation_worker (Paulo Alcantara) [RHEL-127422]
  - smb client: fix bug with newly created file in cached dir (Paulo Alcantara) [RHEL-127422]
  - smb: client: short-circuit negative lookups when parent dir is fully cached (Paulo Alcantara) [RHEL-127422]
  - smb: client: short-circuit in open_cached_dir_by_dentry() if !dentry (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove pointless cfid->has_lease check (Paulo Alcantara) [RHEL-127422]
  - smb: client: remove unused fid_lock (Paulo Alcantara) [RHEL-127422]
  - smb: client: update cfid->last_access_time in open_cached_dir_by_dentry() (Paulo Alcantara) [RHEL-127422]
  - smb: client: ensure open_cached_dir_by_dentry() only returns valid cfid (Paulo Alcantara) [RHEL-127422]
  - smb: client: account smb directory cache usage and per-tcon totals (Paulo Alcantara) [RHEL-127422]
  - smb: client: add drop_dir_cache module parameter to invalidate cached dirents (Paulo Alcantara) [RHEL-127422]
  - smb: client: show lease state as R/H/W (or NONE) in open_files (Paulo Alcantara) [RHEL-127422]
  - smb: client: show negotiated cipher in DebugData (Paulo Alcantara) [RHEL-127422]
  - smb: client: add new tracepoint to trace lease break notification (Paulo Alcantara) [RHEL-127422]
  - smb: client: Fix NULL pointer dereference in cifs_debug_dirs_proc_show() (Paulo Alcantara) [RHEL-127422]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.22.1.el9_7]
changelog:
  - libceph: fix potential use-after-free in have_mon_and_osd_map() (CKI Backport Bot) [RHEL-137400] {CVE-2025-68285}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.23.1.el9_7]
changelog:
  - book3s64/hash: Remove kfence support temporarily (Mamatha Inamdar) [RHEL-135574]
  - xfs: rework datasync tracking and execution (CKI Backport Bot) [RHEL-135714]
  - xfs: rearrange code in xfs_inode_item_precommit (CKI Backport Bot) [RHEL-135714]
  - inetpeer: do not get a refcount in inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: update inetpeer timestamp in inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: remove create argument of inet_getpeer() (Guillaume Nault) [RHEL-116121]
  - inetpeer: remove create argument of inet_getpeer_v[46]() (Guillaume Nault) [RHEL-116121]
  - ipv4/route: avoid unused-but-set-variable warning (Guillaume Nault) [RHEL-116121]
  - arm64: errata: Expand speculative SSBS workaround for Cortex-A720AE (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-A720AE definitions (Waiman Long) [RHEL-130734]
  - arm64: errata: Add missing sentinels to Spectre-BHB MIDR arrays (Waiman Long) [RHEL-130734]
  - arm64: Add support for HIP09 Spectre-BHB mitigation (Waiman Long) [RHEL-130734]
  - arm64: errata: Add newer ARM cores to the spectre_bhb_loop_affected() lists (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add MIDR_CORTEX_A76AE (Waiman Long) [RHEL-130734]
  - arm64: errata: Add KRYO 2XX/3XX/4XX silver cores to Spectre BHB safe list (Waiman Long) [RHEL-130734]
  - arm64: Subscribe Microsoft Azure Cobalt 100 to erratum 3194386 (Waiman Long) [RHEL-130734]
  - arm64: errata: Expand speculative SSBS workaround once more (Waiman Long) [RHEL-130734]
  - arm64: errata: Expand speculative SSBS workaround (again) (Waiman Long) [RHEL-130734]
  - tools headers arm64: Sync arm64's cputype.h with the kernel sources (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Neoverse-N3 definitions (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-A725 definitions (Waiman Long) [RHEL-130734]
  - arm64: cputype: Add Cortex-X1C definitions (Waiman Long) [RHEL-130734]
  - drm/xe: Make dma-fences compliant with the safe access rules (Mika Penttilä) [RHEL-122263] {CVE-2025-38703}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.24.1.el9_7]
changelog:
  - gitlab-ci: use rhel9.7 builder image (Michael Hofmann)
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (Paulo Alcantara) [RHEL-131388] {CVE-2025-39933}
  - tty: n_tty: Fix buffer offsets when lookahead is used (Radostin Stoyanov) [RHEL-130039]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.25.1.el9_7]
changelog:
  - ice: Fix kernel panic due to page refcount underflow (Mohammad Heib) [RHEL-139731]
  - net: atlantic: fix fragment overflow handling in RX path (CKI Backport Bot) [RHEL-139487] {CVE-2025-68301}
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134767]
  - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138493]
  - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139284] {CVE-2025-40248}
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138035] {CVE-2025-38349}
  - block: don't freeze queue for updating queue limits (Ming Lei) [RHEL-135268]
  - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134448] {CVE-2025-40258}
  - uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133868]
  - dpll: zl3073x: Specify phase adjustment granularity for pins (Ivan Vecera) [RHEL-129504]
  - dpll: add phase-adjust-gran pin attribute (Ivan Vecera) [RHEL-129504]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.26.1.el9_7]
changelog:
  - Bluetooth: hci_sock: Prevent race in socket write iter and sock bind (CKI Backport Bot) [RHEL-139462] {CVE-2025-68305}
  - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137949] {CVE-2025-38141}
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136964] {CVE-2025-40294}
  - drm/xe: Fix vm_bind_ioctl double free bug (CKI Backport Bot) [RHEL-122309] {CVE-2025-38731}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.27.1.el9_7]
changelog:
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136822] {CVE-2025-38568}
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (CKI Backport Bot) [RHEL-134923] {CVE-2025-40251}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129112] {CVE-2025-40154}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.28.1.el9_7]
changelog:
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Luiz Capitulino) [RHEL-133337]
  - s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-133337]
  - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137098] {CVE-2025-40271}
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136256] {CVE-2025-40318}
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (CKI Backport Bot) [RHEL-134352] {CVE-2025-38022}
  - cifs: Fix deadlock in cifs_writepages during reconnect (Paulo Alcantara) [RHEL-134234]
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131974] {CVE-2025-37819}
  - net: openvswitch: fix nested key length validation in the set() action (CKI Backport Bot) [RHEL-131801] {CVE-2025-37789}
  - md: avoid repeated calls to del_gendisk (Nigel Croxon) [RHEL-126532]
  - md: delete mddev kobj before deleting gendisk kobj (Nigel Croxon) [RHEL-126532]
  - md: add legacy_async_del_gendisk mode (Nigel Croxon) [RHEL-126532]
  - md: Don't clear MD_CLOSING until mddev is freed (Nigel Croxon) [RHEL-126532]
  - md: fix create on open mddev lifetime regression (Nigel Croxon) [RHEL-126532]
  - md: call del_gendisk in control path (Nigel Croxon) [RHEL-126532]
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128891] {CVE-2025-40141}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.29.1.el9_7]
changelog:
  - squashfs: fix memory leak in squashfs_fill_super (Abhi Das) [RHEL-138015] {CVE-2025-38415}
  - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138015] {CVE-2025-38415}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137364] {CVE-2025-39760}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137069] {CVE-2025-38024}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.30.1.el9_7]
changelog:
  - io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137329] {CVE-2025-38730}
  - io_uring/kbuf: add io_kbuf_commit() helper (Jeff Moyer) [RHEL-137329]
  - io_uring/kbuf: use 'bl' directly rather than req->buf_list (Jeff Moyer) [RHEL-137329]
  - ice: prevent NULL deref in ice_lag_move_new_vf_nodes() (Michal Schmidt) [RHEL-143296]
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Adrian Moreno) [RHEL-141404]
  - atm: clip: Fix infinite recursive call of clip_push(). (Guillaume Nault) [RHEL-137601] {CVE-2025-38459}
  - dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139699]
  - dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139699]
  - dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139699]
  - dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139699]
  - dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139699]
  - dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139699]
  - dpll: fix clock quality level reporting (Ivan Vecera) [RHEL-139699]
  - dpll: add reference sync get/set (Ivan Vecera) [RHEL-139699]
  - dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139699]
  - dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139699]
  - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-129084] {CVE-2025-40170}
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-129084]
  - net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (Hangbin Liu) [RHEL-129084]
  - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-129018] {CVE-2025-40135}
  - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128982] {CVE-2025-40158}
  - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128982]
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128982]
  - net: Add locking to protect skb->dev access in ip_output (Hangbin Liu) [RHEL-128982]
  - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128982]
  - bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6 (Hangbin Liu) [RHEL-128982]
  - vrf: Fix lockdep splat in output path (Hangbin Liu) [RHEL-128982]
  - ipv6: remove nexthop_fib6_nh_bh() (Hangbin Liu) [RHEL-128982]
  - net: remove rcu_dereference_bh_rtnl() (Hangbin Liu) [RHEL-128982]
  - neighbour: switch to standard rcu, instead of rcu_bh (Hangbin Liu) [RHEL-128982]
  - ipv6: flowlabel: do not disable BH where not needed (Hangbin Liu) [RHEL-128982]
  - ipv6: remove one read_lock()/read_unlock() pair in rt6_check_neigh() (Hangbin Liu) [RHEL-128982]
  - neigh: introduce neigh_confirm() helper function (Hangbin Liu) [RHEL-128982]
  - net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-132923]
  - net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-132923]
  - vsock/vmci: Clear the vmci transport packet properly when initializing it (CKI Backport Bot) [RHEL-137697] {CVE-2025-38403}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (CKI Backport Bot) [RHEL-136909] {CVE-2025-40269}
  - nvme: tcp: Fix compilation warning with W=1 (John Meneghini) [RHEL-129928]
  - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (John Meneghini) [RHEL-129928]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.32.1.el9_7]
changelog:
  - svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142790] {CVE-2025-68811}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140260] {CVE-2025-68349}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.33.1.el9_7]
changelog:
  - i40e: avoid redundant VF link state updates (CKI Backport Bot) [RHEL-141877]
  - x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT (Paolo Bonzini) [RHEL-128030]
  - x86/sev: Evict cache lines during SNP memory validation (Paolo Bonzini) [RHEL-128030]
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (Myron Stowe) [RHEL-132891] {CVE-2023-53034}
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137683] {CVE-2025-40304}
  - crypto: iaa - Optimize rebalance_wq_table() (Jay Shin) [RHEL-137272]
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136942] {CVE-2025-40322}
  - bpf: Do not audit capability check in do_jit() (Jay Shin) [RHEL-135137]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.34.1.el9_7]
changelog:
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Li Tian) [RHEL-145183]
  - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-127498]
  - smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-127498]
  - smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-127498]
  - cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-127498]
  - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126890] {CVE-2025-40064}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.35.1.el9_7]
changelog:
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (Paolo Abeni) [RHEL-137841] {CVE-2025-38129}
  - exfat: fix double free in delayed_free (CKI Backport Bot) [RHEL-146403] {CVE-2025-38206}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.36.1.el9_7]
changelog:
  - net/smc: Remove validation of reserved bits in CLC Decline message (Mete Durlu) [RHEL-143718]
  - autofs: dont trigger mount if it cant succeed (Ian Kent) [RHEL-149495]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147266] {CVE-2026-23097}
  - ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148166]
  - fou: Don't allow 0 for FOU_ATTR_IPPROTO. (Xin Long) [RHEL-144987]
  - tools: ynl: Specify --no-line-number in ynl-regen.sh. (Xin Long) [RHEL-144987]
  - gue: Fix skb memleak with inner IP protocol 0. (Xin Long) [RHEL-144987]
  - netlink: specs: fou: replace underscores with dashes in names (Xin Long) [RHEL-144987]
  - fou: fix initialization of grc (Xin Long) [RHEL-144987]
  - fou: Fix null-ptr-deref in GRO. (Xin Long) [RHEL-144987]
  - fou: remove warn in gue_gro_receive on unsupported protocol (Xin Long) [RHEL-144987]
  - fou: Remove XRFM from NET_FOU Kconfig (Xin Long) [RHEL-144987]
  - fou: remove sparse errors (Xin Long) [RHEL-144987]
  - redhat: enable FOU modules in kernel-modules-extra (Xin Long) [RHEL-144987]
  - s390/mm: Fix __ptep_rdp() inline assembly (Mete Durlu) [RHEL-143713]
  - dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146357]
  - dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-147459]
  - dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-147459]
  - i40e: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - ice: add rh_phys_port_name mod option to behave like upstream (CKI Backport Bot) [RHEL-128237]
  - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-146049]
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143545] {CVE-2025-71085}
  - tick/sched: Limit non-timekeeper CPUs calling jiffies update (Phil Auld) [RHEL-141462]
  - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130017] {CVE-2025-40168}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.37.1.el9_7]
changelog:
  - printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148302]
  - printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148302]
  - printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148302]
  - printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148302]
  - printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148302]
  - printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148302]
  - printk: nbcon: Use raw_cpu_ptr() instead of open coding (CKI Backport Bot) [RHEL-148302]
  - backport "printk: Add helper for flush type logic" and associated changes (CKI Backport Bot) [RHEL-148302]
  - printk: Remove redundant deferred check in vprintk() (CKI Backport Bot) [RHEL-148302]
  - printk: Introduce force_legacy_kthread() macro (CKI Backport Bot) [RHEL-148302]
  - printk: Add is_printk_legacy_deferred() (CKI Backport Bot) [RHEL-148302]
  - io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137988]
  - io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137988]
  - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137988] {CVE-2025-38106}
  - io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137988]
  - io_uring/sqpoll: annotate debug task == current with data_race() (Jeff Moyer) [RHEL-137988]
  - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144125] {CVE-2026-23001}
  - net/smc: Fix lookup of netdev by using ib_device_get_netdev() (CKI Backport Bot) [RHEL-114786]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.38.1.el9_7]
changelog:
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143194] {CVE-2025-68800}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.39.1.el9_7]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (CKI Backport Bot) [RHEL-142232] {CVE-2025-39818}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.40.1.el9_7]
changelog:
  - s390/pci: Allow automatic recovery with minimal driver support (CKI Backport Bot) [RHEL-118881]
  - mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported (Luiz Capitulino) [RHEL-143846]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.41.1.el9_7]
changelog:
  - net: vxlan: prevent NULL deref in vxlan_xmit_one (Antoine Tenart) [RHEL-133369]
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Mark Langsdorf) [RHEL-123057]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.31.1.el9_7]
changelog:
  - nvme-tcp: fix NULL pointer dereferences in nvmet_tcp_build_pdu_iovec (CKI Backport Bot) [RHEL-144332] {CVE-2026-22998}


author: Karel Zak <kzak@redhat.com> 2.37.4-21.el9_7
changelog:
  - fix RHEL-134269 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-133955 - login-utils: fix setpwnam() buffer use [CVE-2025-14104]


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-38.2
changelog:
  - Replace statfs64 with statfs (RHEL-127104)
  - NFS export symlink vulnerability fix (RHEL-127104)
  - mountd: Minor refactor of get_rootfh() (RHEL-127104)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127104)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127104)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127104)
    Resolves: CVE-2025-12801


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.2
changelog:
  - fix CVE-2026-25646: heap buffer overflow in png_set_quantize (RHEL-148970)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-148403)
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147343)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.7.el9_7
changelog:
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-140916)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-140916)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-5
changelog:
  - Resolves: RHEL-84480 - nginx:1.24/nginx: specially crafted MP4 file may cause
    denial of service (CVE-2024-7347)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-5.1
changelog:
  - Resolves: RHEL-146526 - nginx:1.24/nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connections (CVE-2026-1642)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-2
changelog:
  - nginx: NGINX: Data injection via man-in-the-middle attack on TLS proxied
    connections (CVE-2026-1642)


author: Gris Ge <fge@redhat.com> - 2.2.57-1
changelog:
  - Upgrade to 2.2.57
  - Use global DNS even for static IP with static DNS. (RHEL-126730)
  - Add libreswan leftprotoport and rightprotoport support. (RHEL-130911


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-3
changelog:
  - restore CONCATENATE functions accidentally removed in the last patch
  - fix big endian issue in tstclnt and selfserv in certificate compression


author: Bob Relyea <rrelyea@redhat.com> - 3.112.0-5
changelog:
  - fips update
  -   Fix indicators for the new post-quantum algorithms
  -   Fix the ML-KEM Self-tests
  -   Fix the ML-KEM zeroizaiton
  -   Add partial public validation before OAEP
  - bug fixes
  -   add CKA_SEED to private attributes so they are updated on password change.
  -   mark CKA_PARAMETER_SET as CK_ULONG when storing into the database
  -   fix unrefrence read in leancrypto.


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.1-7
changelog:
  - Fix CVE-2025-11187 CVE-2025-15467 CVE-2025-15468 CVE-2025-15469
    CVE-2025-66199 CVE-2025-68160 CVE-2025-69418 CVE-2025-69419 CVE-2025-69420
    CVE-2025-69421 CVE-2026-22795 CVE-2026-22796
    Resolves: RHEL-142068
    Resolves: RHEL-142002
    Resolves: RHEL-142055
    Resolves: RHEL-142051
    Resolves: RHEL-142047
    Resolves: RHEL-142043
    Resolves: RHEL-142039
    Resolves: RHEL-142035
    Resolves: RHEL-142031
    Resolves: RHEL-142011
    Resolves: RHEL-142027
    Resolves: RHEL-142023


author: imagebuilder-bot <imagebuilder-bots+imagebuilder-bot@redhat.com> - 149-4
changelog:
  - Rebuilt to fix: 
    - CVE-2025-61726
    - CVE-2025-61728
    - CVE-2025-61729
    - CVE-2025-68121
    - RHEL-146868
    - RHEL-147086
    - RHEL-147371
    - RHEL-149626


author: Chris Lumens <clumens@redhat.com> - 2.1.10-1.1
changelog:
  - Don't evict IPC clients as long as they're still processing messages
  - Don't overwhelm the FSA queue with repeated CIB queries
  - Resolves: RHEL-150167


author: Filip Janus <fjanus@redhat.com> - 1.7.0-1
changelog:
  - Initial import for postgresql 15 module
  - Update to 1.7.0
  - Support postgresql 15
  - Related: #2128410


author: Remi Collet <rcollet@redhat.com> - 8.0.30-5
changelog:
  - Fix Null byte termination in dns_get_record()
    GHSA-www2-q4fc-65wf
  - Fix Heap buffer overflow in array_merge()
    CVE-2025-14178
  - Fix Information Leak of Memory in getimagesize
    CVE-2025-14177


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/a58af02)
  - fixes "[podman 5.6][runc 1.3.3] podman update can not update the io related options with runc"
  - Resolves: RHEL-81042


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/0a20b84)
  - fixes "CVE-2025-47913 podman: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS [rhel-9.7.z]"
  - Resolves: RHEL-134793


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-12
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/360c775)
  - fixes "[podman-5.6] Crash in podman-system-migrate due to nil c.runtime.storageService [rhel-9.7.z]"
  - Resolves: RHEL-141491


author: Jindrich Novy <jnovy@redhat.com> - 6:5.6.0-13
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.6-rhel
    (https://github.com/containers/podman/commit/1dce7a7)
  - fixes "Podman 5.6 regression: container fails to start when WORKDIR is a symlink (“file exists” error) [rhel-9.7.z]"
  - Resolves: RHEL-142311


author: Filip Janus <fjanus@redhat.com> - 16.11-1
changelog:
  - Update to 16.11
  - Add sysusers configuration and generate tmpfiles.d dynamically
  - Resolves: RHEL-123193 (CVE-2025-12818)


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-5.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143104 RHEL-143167 RHEL-144890


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-4.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143106 RHEL-143168 RHEL-144891


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-3.1
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143108 RHEL-143169 RHEL-144893


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-29.el9_7.4
changelog:
  - kvm-accel-kvm-check-for-KVM_CAP_READONLY_MEM-on-VM.patch [RHEL-129551]
  - kvm-ram-block-attributes-fix-interaction-with-hugetlb-me.patch [RHEL-129551]
  - kvm-ram-block-attributes-Unify-the-retrieval-of-the-bloc.patch [RHEL-129551]
  - kvm-scsi-disk-Apply-error-policy-for-host_status-errors-.patch [RHEL-130209]
  - Resolves: RHEL-129551
    ([RHEL 9]snp guest fail to boot with hugepage [rhel-9.7.z])
  - Resolves: RHEL-130209
    (scsi-block: Error policy is ignored for host_status errors [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-29.el9_7.5
changelog:
  - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-133302]
  - Resolves: RHEL-133302
    (The VM hit io error when do S3-PR integration on the pass-through  failover multipath device [rhel-9.7.z])


author: Jon Maloy <jmaloy@redhat.com> - 9.1.0-29.el9_7.6
changelog:
  - kvm-Revert-i386-cpu-Move-adjustment-of-CPUID_EXT_PDCM-be.patch [RHEL-135451]
  - Resolves: RHEL-135451
    (Live migration after workload update fails with operation failed: guest CPU doesn't match specification: missing features: pdcm [rhel-9])


author: Matyas Horky <mhorky@redhat.com> - 0.2.7-2
changelog:
  - Bump release for rebuild
  - Resolves: RHEL-146870
  - Resolves: CVE-2025-61726
  - Resolves: RHEL-147088
  - Resolves: CVE-2025-61729
  - Resolves: RHEL-149629
  - Resolves: CVE-2025-68121


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.11-2
changelog:
  - Backport https://github.com/bootc-dev/bootc/pull/1917
    Backport https://github.com/coreos/rpm-ostree/pull/5551
    Resolves: #RHEL-143209
    Resolves: #RHEL-143216


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-1
changelog:
  - Resolves: RHEL-111229 - Error showing local password policy on web UI [rhel-9]
  - Resolves: RHEL-112680 - Statistics about index lookup report a wrong duration [rhel-9]
  - Resolves: RHEL-116426 - RetroCL plugin generates invalid LDIF [rhel-9]
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-117748 - The numSubordinates value is not matching the number of direct children. [rhel-9]
  - Resolves: RHEL-117771 - When deferred memberof update is enabled after the server crashed it should not launch memberof fixup task by default
  - Resolves: RHEL-117782 - Ignore the memberOfDeferredUpdate setting when LMDB is used.  [rhel-9]
  - Resolves: RHEL-121170 - Units for changing MDB max size are not consistent across different tools [rhel-9]
  - Resolves: RHEL-123231 - Improve the way to detect asynchronous operations in the access logs [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123258 - Typo in errors log after a Memberof fixup task. [rhel-9]
  - Resolves: RHEL-123272 - LDAP high CPU usage while handling indexes with IDL scan limit at INT_MAX [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-123368 - IPA health check up script shows time skew is over 24 hours [rhel-9]
  - Resolves: RHEL-123766 - 389-ds-base OpenScanHub Leaks Detected [rhel-9]
  - Resolves: RHEL-123893 - Improve output dsctl dbverify when backend does not exist [rhel-9]
  - Resolves: RHEL-123897 - [WebUI] Replication tab crashes after enabling replication as a consumer [rhel-9]
  - Resolves: RHEL-123923 - Changelog trimming - add number of scanned entries to the log [rhel-9]
  - Resolves: RHEL-126552 - RHDS 12.6 doesn't handle 'ldapsearch' filter with space char in DN name correctly [rhel-9]
  - Resolves: RHEL-129559 - Online initialization of consumers fails with error -23 [rhel-9]
  - Resolves: RHEL-129580 - Fix paged result search locking [rhel-9]
  - Resolves: RHEL-138481 - Memory leak observed in ns-slapd with 389-ds-base-2.6.1-12 [rhel-9]
  - Resolves: RHEL-139825 - Rebase 389-ds-base to 2.8.x
  - Resolves: RHEL-140089 - Upgrading IDM  to latest version: 389-ds-base and ipa-server breaks replication  [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-2
changelog:
  - Resolves: RHEL-140089 - Upgrading IDM to latest version: 389-ds-base and ipa-server breaks replication [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-3
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123244 - Attribute uniqueness is not enforced upon modrdn operation [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-4
changelog:
  - Resolves: RHEL-117050 - Replication online reinitialization of a large database gets stalled. [rhel-9]
  - Resolves: RHEL-123279 - The new ipahealthcheck test ipahealthcheck.ds.backends.BackendsCheck raises CRITICAL issue [rhel-9]
  - Resolves: RHEL-140275 - ipa-healthcheck is complaining about missing or incorrectly configured system indexes. [rhel-9]
  - Resolves: RHEL-142980 - Scalability issue of replication online initialization with large database [rhel-9]
  - Resolves: RHEL-146899 - memory corruption in alias entry plugin [rhel-9]
  - Resolves: RHEL-147212 - Access logs are not getting deleted as configured. [rhel-9]
  - Resolves: RHEL-150907 - Remove memberof_del_dn_from_groups from MemberOf plugin [rhel-9]


author: Viktor Ashirov <vashirov@redhat.com> - 2.8.0-5
changelog:
  - Resolves: RHEL-137084 - CVE-2025-14905 389-ds-base: 389-ds-base: Remote Code Execution and Denial of Service via heap buffer overflow [rhel-9.8]
  - Resolves: RHEL-152335 - Crash in trim_changelog() during the Retro Changelog trimming. [rhel-9.8]
  - Resolves: RHEL-152338 - Crash ( Segmentation fault ) in atomic_compare_exchange() [rhel-9.8]


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.7-1
changelog:
  - pyanaconda: payload: return exception details for payload failures
    (k.koukiou)
  - ui: tui: installation_source: show error message in the TUI screen
    (k.koukiou)
    Resolves: RHEL-4705
  - storage: fix mount point assignment of non-formatted swap partitions
    (rvykydal)
    Related: RHEL-16355
  - storage: include only fstab devices in fsset swap devices property (rvykydal)
    Resolves: RHEL-16355


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.8-1
changelog:
  - Fix: UnboundLocalError: local variable 'e' referenced before assignment
    (k.koukiou)
    Related to: RHEL-4705
  - Emit authselect in KS when fingerprint is enabled (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.9-1
changelog:
  - Set Authselect agruments after run in Security module (adamkankovsky)
    Resolves: RHEL-85175
  - Authselect code simplification (adamkankovsky)
    Resolves: RHEL-85175
  - custom: Reallocate partitions when removing a partition (vtrefny)
    Resolves: RHEL-114169


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.10-1
changelog:
  - Fixing authselect logical differences not resolved during backporting
    (adamkankovsky)
    Resolves: RHEL-85175


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.11-1
changelog:
  - bootloader: efi: utilize grub2-common script for handling config file
    generation (k.koukiou)
    Resolves: RHEL-36187


author: Katerina Koukiou <k.koukiou@gmail.com> - 34.25.7.12-1
changelog:
  - Fix permissions of the ssh config created by Anaconda (ppolawsk)
    Resolves: RHEL-129787
  - pyanaconda: rpm_ostree: fix _handle_boot_if_not_mount_point method issues
    (k.koukiou)
    Related: RHEL-74145
  - ostree needs to have /boot be bindmounted into sysroot. (a.badger)
    Resolves: RHEL-74145


author: Jindrich Novy <jnovy@redhat.com> - 3:2.2.1-1
changelog:
  - update to https://github.com/containers/conmon/releases/tag/v2.2.1
  - enable RELRO
  - Related: RHEL-111919


author: Yasmin Valim <ydesouza@redhat.com> - 0.24.0-4
changelog:
  - Check if firstboot args are defined and add them manually 
    Backport https://github.com/coreos/coreos-installer/pull/1699


author: Yasmin Valim <ydesouza@redhat.com> - 0.24.0-5
changelog:
  - Uses blkid -p instead of lsblk to bypass the cache
    Backport https://github.com/coreos/coreos-installer/pull/1692


author: Jan Friesse <jfriesse@redhat.com> - 3.1.9-2.1
changelog:
  - Resolves: RHEL-163815
  - Resolves: RHEL-163836

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Jindrich Novy <jnovy@redhat.com> - 1.27-1
changelog:
  - update to https://github.com/containers/crun/releases/tag/1.27
  - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the `--user` option [rhel-9.7.z]
  - Resolves: RHEL-161439


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-35
changelog:
  - RHEL-102665 The KONICA MINOLTA C352 is not distributed using cups-browsed and the included ppd file


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:2.3.3op2-37
changelog:
  - RHEL-129747 CVE-2025-58436 cups: Slow client communication leads to a possible DoS attack
  - RHEL-129740 CVE-2025-61915 cups: Local denial-of-service via cupsd.conf update and related issues


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-15.1
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161639)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162287)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161678)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-16
changelog:
  - add /var/lib/dovecot to tmpfiles for image mode (RHEL-139098)
  - fix building with latest openssl (RHEL-140619)


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4-1
changelog:
  - fapolicyd-1.4 and fapolicyd-selinux-1.0
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-1
changelog:
  - fapolicyd-1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd/releases/tag/v1.4.3
    https://github.com/linux-application-whitelisting/fapolicyd-selinux/releases/tag/v1.1


author: Petr Lautrbach <lautrbach@redhat.com> - 1.4.3-2
changelog:
  - Fix binary path of rpm-loader
  - Map file with MAP_SHARED instead of MAP_PRIVATE
  - Fix segfault when interrupting fapolicyd startup


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-98.12
changelog:
  - bundled cryptography: replace with dependency to fix CVE-2026-26007
  - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
    Resolves: RHEL-148436, RHEL-155675


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-100
changelog:
  - fence_ibm_powervs: update description of api-type parameter to show
    correct default value
    Resolves: RHEL-114753


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-105
changelog:
  - bundled urllib3: fix CVE-2025-66471
  - bundled urllib3: fix CVE-2026-21441
    Resolves: RHEL-139799, RHEL-140796


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-110
changelog:
  - bundled urllib3: fix CVE-2024-37891, CVE-2025-66418, CVE-2025-66471,
    CVE-2026-21441, and pyasn1 CVE-2026-23490 on all archs
    Resolves: RHEL-146344


author: Lukáš Zaoral <lzaoral@redhat.com>- 3.0.4-9
changelog:
  - backport the following fixes from Fedora:
    - fix header conflicts in multilib installs (RHEL-134741)
    - fix rpmlint warnings


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.4
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148046, RHEL-148049, RHEL-148054, RHEL-148061, RHEL-148079
    Resolves: RHEL-148094, RHEL-148096, RHEL-148104, RHEL-148939, RHEL-149029
    Resolves: RHEL-149042, RHEL-149065, RHEL-155993


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.6
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-162958, RHEL-162978


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-1.7
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159815, RHEL-155477, RHEL-161046, RHEL-161481
    Resolves: RHEL-161517, RHEL-161084, RHEL-167803


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-3
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-142427, RHEL-142411, RHEL-142395, RHEL-142379, RHEL-142363
    Resolves: RHEL-142348, RHEL-142332


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-6
changelog:
  - Backport several CVE fixes
    Resolves: RHEL-148052, RHEL-148053, RHEL-148056, RHEL-148075, RHEL-148081
    Resolves: RHEL-148098, RHEL-148105, RHEL-148106, RHEL-148941, RHEL-149032
    Resolves: RHEL-149043, RHEL-149066, RHEL-155994


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Siddhesh Poyarekar <siddhesh@redhat.com> 15.2.1-7
changelog:
  - update from releases/gcc-15 branch (RHEL-116513)
    - PRs ada/68179, ada/123060, ada/123088, ada/123096, ada/123138, ada/123185,
  	ada/123289, ada/123302, ada/123306, ada/123371, ada/123589,
  	analyzer/122975, analyzer/123085, c/123156, c++/91388, c++/114764,
  	c++/116952, c++/120446, c++/121854, c++/121966, c++/122048,
  	c++/122070, c++/122550, c++/122668, c++/122752, c++/122772,
  	c++/122834, c++/122922, c++/123331, c++/123597, debug/121964,
  	diagnostics/120063, fortran/107406, libfortran/122936,
  	libstdc++/120446, libstdc++/122812, libstdc++/122907,
  	libstdc++/123147, middle-end/111817, middle-end/123107,
  	middle-end/123392, middle-end/123703, rtl-optimization/121773,
  	rtl-optimization/122215, rtl-optimization/123121,
  	rtl-optimization/123523, target/117575, target/119130,
  	target/120250, target/121192, target/121485, target/123022,
  	target/123092, target/123155, target/123217, target/123460,
  	target/123484, target/123489, target/123521, target/123607,
  	target/123742, testsuite/123353, tree-optimization/122793,
  	tree-optimization/122868, tree-optimization/123040,
  	tree-optimization/123300, tree-optimization/123351,
  	tree-optimization/123372, tree-optimization/123431,
  	tree-optimization/123513, tree-optimization/123602,
  	tree-optimization/123736, tree-optimization/123741


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-1.5
changelog:
  - fix CVE-2026-4150
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-1
changelog:
  - Rebase to 3.8.10
  - Revert defaulting to PBMAC1 in FIPS mode
  - Revert unapproving 1024-, 1280-, 1536- and 1792-bit RSA verification


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-18
changelog:
  - Resolves RHEL-125696: CVE-2025-58183
  - Resolves RHEL-132757: Grafana-selinux prevents plugins from searching cgroups


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-20
changelog:
  - Resolves RHEL-144960: CVE-2026-21721
  - Resolves RHEL-145419: CVE-2025-61728
  - Resolves RHEL-146103: CVE-2025-61726
  - Resolves RHEL-149639: CVE-2025-68121


author: Paul Whalen <pwhalen@fedoraproject.org> - 0.16.0-2
changelog:
  - Update src to greenboot-rs, binaries remain greenboot
  - Obsoletes/Conflicts for bash greenboot, Provides greenboot


author: Sayan Paul <saypaul@redhat.com> - 0.16.1
changelog:
  - Ensure rollback trigger runs before systemd-update-done and only on updates
  - Log the correct system type when reporting rollback decisions
  - Fix CI/tests (Ansible callback config, GI deps) to keep gating green
  - Refresh Packit release config for Fedora delivery


author: Sayan Paul <saypaul@redhat.com> - 0.16.2
changelog:
  - restrict manual restart of healthcheck service
  - fixed error while running healtcheck inside container
  - removed bootupd dependency
  - fixed CI tests


author: Jindrich Novy <jnovy@redhat.com> - 6:0.8.7-1
changelog:
  - update to https://github.com/containers/gvisor-tap-vsock/releases/tag/v0.8.7
  - Resolves: RHEL-112184


author: David Hanina <dhanina@redhat.com> - 4.12.2-22.4
changelog:
  - Resolves: RHEL-155038 Pagure #9953: Adding a group with 32Bit Idrange fails.
  - Resolves: RHEL-153628 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-153621 Pagure #9854: Erroneous case-sensitivity in offline DSE lookup


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-24
changelog:
  - Resolves: RHEL-118448 CVE-2025-7493 ipa: Privilege escalation from host to domain admin in FreeIPA


author: Florence Blanc-Renaud <flo@redhat.com> - 4.12.2-25
changelog:
  - Resolves: RHEL-128238 [RFE] Support storing LWCA private keys on an HSM [rhel-9]
  - Resolves: RHEL-126515 RFE: Enable external password reset agents to use ipa_pwd_extop in RHEL IdM [rhel-9]
  - Resolves: RHEL-73399 RFE: Update IdM password policy configurations to meet M-22-09 by restricting spaces and require number character class
  - Resolves: RHEL-128241 ATTR_NAME_BY_OID is missing OID 2.5.4.97, organizationIdentifier [rhel-9]
  - Resolves: RHEL-126514 [RFE] ipa-client-automount should have an option to include domain of the machine. [rhel-9]
  - Resolves: RHEL-124171 Include latest fixes in python3-ipatests package 
  - Resolves: RHEL-120514 Include fixes in python3-ipatests [rhel-9.8]
  - Resolves: RHEL-118609 test_cacert_manage fails due to expired Let's Encrypt R3 certificate


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.0-1
changelog:
  - Resolves: RHEL-134542 Add modern WebUI as submodule and enable routing in Apache 
  - Resolves: RHEL-134540 Switch IPA to use the PKI python API directly rather than RPC calls
  - Resolves: RHEL-134196 After upgrade from 9.7 to 9.8 ipactl restart fails to restart winbind service 
  - Resolves: RHEL-132334 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-129224 Fix ipatests for kdcproxy after CVE-2025-59088 fix
  - Resolves: RHEL-126974 Minor typo in ipa_idrange_fix.py
  - Resolves: RHEL-120954 Rebase ipa to latest 4.13.x version for RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-1
changelog:
  - Resolves: RHEL-141446 [RFE] Command that retrieve and install new CA certificates
  - Resolves: RHEL-140584 Support replaceable WebUI artwork for RHEL and CentOS
  - Resolves: RHEL-141297 Memory leaks in IPA plugins
  - Resolves: RHEL-141054 IPA fails to sign zone
  - Resolves: RHEL-138570 AddressSanitizer: SEGV ipa-pwd-extop/common.c:584 in ipapwd_gen_checks
  - Resolves: RHEL-138473 Include latest fixes in python3-ipatests package
  - Resolves: RHEL-137585 ipa-server-upgrade succeeds but ipactl restart fails due to ipa-dnskeysyncd service failure caused by SELinux AVC denial on RHEL 9.8


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-2
changelog:
  - RHEL-147191 ipa uninstallation is failing with message "'NoneType' object has no attribute 'lower'"
  - RHEL-146185 Names of domains from a trusted forest should be compared case-insentive
  - RHEL-146184 ipa-advise client script requires keytab (should just require root access on client system)
  - RHEL-145854 Include latest fixes in python3-ipatests package
  - RHEL-143684 When using xmlrpc, ipa server failed with assert type(value) in (unicode, float, int, bool, type(None))
  - RHEL-141500 ipa use systemd-sysusers


author: Florence Blanc-Renaud <flo@redhat.com> - 4.13.1-3
changelog:
  - RHEL-148282 ipa-replica-conncheck fails with "an internal error has occured"
  - RHEL-148481 Pruning is enabled by default with RSN on RHEL 9.8


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142687
  - Related: RHEL-139534
  - Related: RHEL-131588
  - Related: RHEL-131600
  - Related: RHEL-142875
  - Related: RHEL-142697


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.482.b08-3
changelog:
  - Update tagging scripts to include signature checks and correctly handle gating
  - Add gating scripts to simplify obtaining results and waiving issues
  - Resolves: RHEL-147634
  - Resolves: RHEL-151197


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:1.8.0.492.b09-1
changelog:
  - Update to 8u492-b09 (GA)
  - Update release notes for 8u492-b09.
  - Add missing CVEs for 8u482.
  - Regenerate JDK-8199936/PR3533 patch following JDK-8374917
  - Regenerate JDK-8186464/RH1433262 patch following JDK-8370986
  - Drop local giflib 5.2.2 patch now JDK-8328999 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump LCMS 2 version to 2.15.0 following JDK-8303482
  - Bump libpng version to 1.6.57 following JDK-8375063, JDK-8377526, JDK-8380959 & JDK-8382047
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169446
  - Resolves: RHEL-133291
  - Resolves: RHEL-147348
  - Resolves: RHEL-148407
  - Resolves: RHEL-148981
  - Resolves: RHEL-161303
  - Resolves: RHEL-161452
  - Resolves: RHEL-157139
  - Resolves: RHEL-157156


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.7-0.1.ea
changelog:
  - Update to jdk-17.0.18+7 (EA)
  - Add to .gitignore openjdk-17.0.18+7-ea.tar.xz
  - Set updatever to 18
  - Set buildver to 7
  - Set is_ga to 0
  - Update sources to openjdk-17.0.18+7-ea.tar.xz
  - Set bundled libpng version to 1.6.51
  - Resolves: RHEL-131590
  - Resolves: RHEL-131601
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-1
changelog:
  - Update to jdk-17.0.18+8 (GA)
  - Add to .gitignore openjdk-17.0.18+8.tar.xz
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set buildver to 8
  - Set is_ga to 1
  - Update sources to openjdk-17.0.18+8.tar.xz
  - Resolves: RHEL-139552
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set rpmrelease to 2
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-centos-9
  - Set fipsver to e1780dd5d39
  - Resolves: RHEL-122136


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Add test to ensure blocked.certs is valid (OPENJDK-4362)
  - Restore NEWS file so portable can be rebuilt
  - Resolves: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.18.0.8-2
changelog:
  - Set portablerelease to 2
  - Remove test to ensure blocked.certs is valid, done in portable
  - Related: RHEL-122136
  - Related: RHEL-131590
  - Related: RHEL-131601
  - Related: RHEL-139552
  - Related: RHEL-149327


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:17.0.19.0.10-1
changelog:
  - Update to jdk-17.0.19+10 (GA)
  - Add to .gitignore openjdk-17.0.19+10.tar.xz
  - Set updatever to 19
  - Set buildver to 10
  - Set rpmrelease to 1
  - Update sources to openjdk-17.0.19+10.tar.xz
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Set tzdata requires and build requires to 2026a
  - Set bundled freetype library version to 2.14.2
  - Set bundled giflib library version to 6.1.2
  - Set bundled harfbuzz library version to 12.3.2
  - Set bundled libpng library version to 1.6.57
  - Set bundled zlib library version to 1.3.2
  - Set fipsver to 62c0f885e30
  - Sync NEWS from openjdk-portable-rhel-8
  - Sync java-17-openjdk-portable.specfile from openjdk-portable-rhel-8
  - Set portablerelease to 1
  - Resolves: RHEL-133292
  - Resolves: RHEL-147350
  - Resolves: RHEL-148408
  - Resolves: RHEL-148987
  - Resolves: RHEL-161296
  - Resolves: RHEL-161445
  - Resolves: RHEL-157135


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.10.0.7-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-142859
  - Related: RHEL-139560
  - Related: RHEL-131592
  - Related: RHEL-131602
  - Related: RHEL-122121
  - Related: RHEL-142820


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:21.0.11.0.10-1
changelog:
  - Update to jdk-21.0.11+10 (GA)
  - Update release notes to 21.0.11+10
  - Update FIPS patch to feef2dc3ca7 version synced with 21.0.11+9 and adapted to JDK-8244336
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 21.0.13
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169609
  - Resolves: RHEL-133293
  - Resolves: RHEL-147352
  - Resolves: RHEL-148409
  - Resolves: RHEL-148992
  - Resolves: RHEL-157141
  - Resolves: RHEL-161305
  - Resolves: RHEL-161454
  - Resolves: RHEL-169616


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-1
changelog:
  - Update to jdk-25.0.2+10 (GA)
  - Update release notes to 25.0.2+10
  - Add JDK-8372534 libpng 1.6.51 ahead of 25.0.3
  - Bump libpng version to 1.6.51 following JDK-8372534
  - Bump ID of NSS adapter patch so we can stay in sync with portable on the libpng patch
  - Test for java.security's existence in create-redhat-properties-files.bash
  - Handle 'upgrade' as an alternative to 'update' in openjdk_news.sh
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-01-20 @ 1pm PT. **
  - Resolves: RHEL-139577
  - Resolves: RHEL-143373
  - Resolves: RHEL-143368
  - Resolves: RHEL-142856
  - Resolves: RHEL-142808


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-2
changelog:
  - Bump rpmrelease for CentOS build
  - Related: RHEL-139577
  - Related: RHEL-142856
  - Related: RHEL-142808


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Update FIPS patch to e55ada9353e to include the fix for the too restrictive provider lockdown
  - Fix FIPS issue list to represent the new 25u version
  - Add JDK-8375063 libpng 1.6.54 ahead of 25.0.3
  - Add JDK-8375057 harfbuzz 12.3.2 ahead of 25.0.3
  - Add JDK-8377526 libpng 1.6.55 ahead of 25.0.3
  - Bump libpng version to 1.6.55 following JDK-8375063 & JDK-8377526
  - Bump harfbuzz version to 12.3.2 following JDK-8375057
  - Bump nssadapter version to bring in shared PKCS11 session fix
  - Drop LDFLAGS nssadapter patch which is now upstream in 0.1.1
  - Add tagging scripts with signature checks and gating handling
  - Update tagged versions to include 9.8.0-z, 9.9.0, 10.2-z & 10.3.
  - Add gating scripts to simplify obtaining results and waiving issues
  - Sync the copy of the portable specfile with the latest update
  - Resolves: RHEL-155001
  - Resolves: RHEL-147354
  - Resolves: RHEL-148410
  - Resolves: RHEL-148997
  - Resolves: RHEL-155047
  - Resolves: RHEL-155330
  - Resolves: RHEL-156036
  - Resolves: RHEL-156040


author: Thomas Fitzsimmons <fitzsim@redhat.com> - 1:25.0.2.0.10-3
changelog:
  - Disable abidiff inspection in rpminspect.yaml to avoid an out-of-memory error on the CentOS test farm
  - See: https://docs.testing-farm.io/Testing%20Farm/0.1/errors.html#TFE-1
  - Resolves: RHEL-149786


author: Andrew Hughes <gnu.andrew@redhat.com> - 1:25.0.3.0.9-1
changelog:
  - Update to jdk-25.0.3+9 (GA)
  - Update release notes to 25.0.3+9
  - Update FIPS patch to 57722aab802 version synced with 25.0.3+8
  - Drop local libpng patches now JDK-8372534, JDK-8375063 & JDK-8377526 are included upstream
  - Drop local HarfBuzz patch now JDK-8375057 is included upstream
  - Bump freetype version to 2.14.2 following JDK-8373290 & JDK-8379158
  - Bump giflib version to 6.1.2 following JDK-8379256 & JDK-8380078
  - Bump libpng version to 1.6.57 following JDK-8380959 & JDK-8382047
  - Bump zlib version to 1.3.2 following JDK-8378631
  - Add JDK-8375294 EOPNOTSUPP patch ahead of 25.0.4
  - Sync the copy of the portable specfile with the latest update
  - ** This tarball is embargoed until 2026-04-21 @ 1pm PT. **
  - Resolves: RHEL-169619
  - Resolves: RHEL-157142
  - Resolves: RHEL-157154
  - Resolves: RHEL-161306
  - Resolves: RHEL-161455
  - Resolves: RHEL-169615


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.42.1.el9_7]
changelog:
  - scsi: qla2xxx: Allow recovery for tape devices (Ewan D. Milne) [RHEL-153437]
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (Brian Foster) [RHEL-142600]
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (Herton R. Krzesinski) [RHEL-128734]
  - kbuild: use $(srctree)/$(src) for some Makefiles to fix the buildcheck test (Herton R. Krzesinski) [RHEL-106032]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.43.1.el9_7]
changelog:
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150422] {CVE-2026-23193}
  - ALSA: aloop: Fix racy access at PCM trigger (CKI Backport Bot) [RHEL-150130] {CVE-2026-23191}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146421] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146421] {CVE-2025-38323}
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125460] {CVE-2025-40096}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.44.1.el9_7]
changelog:
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152551]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154395]
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-154395]
  - smb: client: fix potential UAF and double free in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
  - smb/client: fix memory leak in smb2_open_file() (Paulo Alcantara) [RHEL-154395]
  - smb: client: split cached_fid bitfields to avoid shared-byte RMW races (Paulo Alcantara) [RHEL-154395]
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152383] {CVE-2026-23171}
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CKI Backport Bot) [RHEL-150477] {CVE-2026-23144}
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150226]
  - macvlan: fix error recovery in macvlan_common_newlink() (CKI Backport Bot) [RHEL-150226] {CVE-2026-23209}
  - dpll: zl3073x: Fix output pin phase adjustment sign (CKI Backport Bot) [RHEL-149764]
  - scsi: s390: zfcp: Ensure synchronous unit_add (CKI Backport Bot) [RHEL-143736]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.45.1.el9_7]
changelog:
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150403] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150403]
  - iommu: Skip PASID validation for devices without PASID capability (Eder Zulian) [RHEL-95264]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.46.1.el9_7]
changelog:
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154094]
  - net: mana: Reduce waiting time if HWC not responding (Maxim Levitsky) [RHEL-92243]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.47.1.el9_7]
changelog:
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154537] {CVE-2025-38109}
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153269] {CVE-2026-23231}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150245] {CVE-2026-23210}
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149748] {CVE-2026-23111}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.48.1.el9_7]
changelog:
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159222] {CVE-2025-68741}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151414]
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-151728]
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-151728]
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-151728]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-150571]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150455] {CVE-2025-39766}
  - iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144218]
  - iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144218]
  - i40e: validate ring_len parameter against hardware-specific values (CKI Backport Bot) [RHEL-141722]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.49.1.el9_7]
changelog:
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149469] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.50.1.el9_7]
changelog:
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158987]
  - md/raid1: fix data lost for writemostly rdev (Nigel Croxon) [RHEL-143624]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.51.1.el9_7]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167016] {CVE-2026-31402}
  - i40e: support generic devlink param "max_mac_per_vf" (Mohammad Heib) [RHEL-121643]
  - devlink: Add new "max_mac_per_vf" generic device param (Mohammad Heib) [RHEL-121643]
  - i40e: improve VF MAC filters accounting (Mohammad Heib) [RHEL-121643]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.53.1.el9_7]
changelog:
  - tracing: Fix a warning when allocating buffered events fails (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix a possible race when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - tracing: Fix incomplete locking when disabling buffered events (CKI KWF BOT) [RHEL-169366]
  - thunderbolt: Fix wake on connect at runtime (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Fix a logic error in wake on connect (Desnes Nunes) [RHEL-104807]
  - thunderbolt: Use wake on connect and disconnect over suspend (Desnes Nunes) [RHEL-104807]
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155311]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157327] {CVE-2026-23270}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.54.1.el9_7]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Vladislav Dronov) [RHEL-172201]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - reject short ahash digests during instance creation (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Fix src offset when decrypting in-place (Vladislav Dronov) [RHEL-172201]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Vladislav Dronov) [RHEL-172201] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Vladislav Dronov) [RHEL-172201]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Vladislav Dronov) [RHEL-172201] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Vladislav Dronov) [RHEL-172201] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Vladislav Dronov) [RHEL-172201]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-611.55.1.el9_7]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174561] {CVE-2026-43284}


author: Tomas Halman <thalman@redhat.com> - 2.7.0-12
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: Michal Ruprich <mruprich@redhat.com> - 4.9.2-8
changelog:
  - Adding a timeout for TLS close
  - Resolves: RHEL-113471 - "cannot seek on data source" in TLS lftp sessions


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-12.4
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161436)


author: Jiri Denemark <jdenemar@redhat.com> - 10.10.0-15.9.el9_7
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154551)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154551)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154551)
  - docs: Clarify host-model description in domain capabilities (RHEL-154551)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-3
changelog:
  - util: json: Increase JSON nesting limit when parsing to 300 (RHEL-135128)
  - virjsontest: Add test for nesting depth (RHEL-135128)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_SYNIC dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - qemu_validate: Drop VIR_DOMAIN_HYPERV_STIMER dependency on VIR_DOMAIN_HYPERV_VPINDEX (RHEL-138689)
  - esx_util: Introduce esxUtil_EscapeInventoryObject() (RHEL-134127)
  - esx: URI encode inventory objects twice (RHEL-134127)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624)
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126345)
  - qemu: Introduce privateData for hostdevs (RHEL-126345)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126345)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126345)
  - qemu: open iommufd FD from libvirt backend (RHEL-126345)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614)
  - qemu: Implement support for persistent reservation migration control (RHEL-140614)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866)
  - Introduce support for disk operation latency histogram collection (RHEL-147866)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353)
  - util: Move openning IOMMU device to viriommufd (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353)
  - util: Move openning VFIO device to virpci (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150353)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353)
  - qemu: Save IOMMUFD state into status XML (RHEL-150353)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150353)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353)
  - conf: Introduce iommufd enum for domaincaps (RHEL-138544)
  - qemu: Fill iommufd domain capability (RHEL-138544)
  - tests: properly mock VFIO and IOMMU checks (RHEL-138544)
  - iommufd: fix FD leak in case of error (RHEL-150353)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - domain_conf: initialize network hostdev private data (RHEL-151953)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-8
changelog:
  - Resolves: RHEL-114501 Image mode: The dir /var/www is not created when
    updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-9
changelog:
  - Resolves: RHEL-105446 - mod_proxy_hcheck may stop healthchecks after a child
    process is reclaimed


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-10
changelog:
  - Resolves: RHEL-119000 - mod_ssl: allow more fine grained SSL SNI vhost check
    to avoid unnecessary 421 errors after CVE-2025-23048 fix
  - mod_ssl: add conf.d/snipolicy.conf to set 'SSLVHostSNIPolicy authonly' default


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-12
changelog:
  - Resolves: RHEL-135064 - httpd: Apache HTTP Server: mod_userdir+suexec bypass
    via AllowOverride FileInfo (CVE-2025-66200)
  - Resolves: RHEL-135049 - httpd: Apache HTTP Server: CGI environment variable
    override (CVE-2025-65082)
  - Resolves: RHEL-134481 - httpd: Apache HTTP Server: Server Side Includes adds
    query string to #exec cmd=... (CVE-2025-58098)


author: Luboš Uhliarik <luhliari@redhat.com> - 2.9.6-4
changelog:
  - Resolves: RHEL-30628 - mod_security: httpd doesn't close read side of pipe
    to rotatelogs for SecAuditLog leading to frozen state during graceful restart


author: Josef Ridky <jridky@redhat.com> - 1:5.9.1-18
changelog:
  - fix inverted usage of -n in snmptrapd (RHEL-101078)
  - fix use after free issue (RHEL-121091)
  - fix help and manpage for net-snmp-create-v3-user 
    script(RHEL-101614 and RHEL-103557)


author: Scott Mayhew <smayhew@redhat.com> 2.5.4-42
changelog:
  - Replace statfs64 with statfs (RHEL-127105)
  - NFS export symlink vulnerability fix (RHEL-127105)
  - mountd: Minor refactor of get_rootfh() (RHEL-127105)
  - mountd: Separate lookup of the exported directory and the mount path (RHEL-127105)
  - support: Add a mini-library to extract and apply RPC credentials (RHEL-127105)
  - Fix access checks when mounting subdirectories in NFSv3 (RHEL-127105)
  - Add requires for selinux-policy (RHEL-127105)
    Resolves: CVE-2025-12801


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-3
changelog:
  - Resolves: RHEL-159559 - CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of
    Service or file modification via buffer overflow in ngx_http_dav_module


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-4
changelog:
  - Resolves: RHEL-159538 - CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of
    Service due to memory corruption via crafted MP4 file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-5
changelog:
  - Resolves: RHEL-159446 - CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of
    Service via undisclosed requests when ngx_mail_auth_http_module is
    enabled


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-6
changelog:
  - Resolves: RHEL-157887 - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of
    Service or Code Execution via specially crafted MP4 files


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.24.0-5.2
changelog:
  - Resolves: RHEL-157886 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of
    Service or Code Execution via specially crafted MP4 files
  - Resolves: RHEL-159445 CVE-2026-27651 nginx:1.24/nginx: NGINX: Denial of
    Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-159558 CVE-2026-27654 nginx:1.24/nginx: NGINX: Denial of
    Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159537 CVE-2026-27784 nginx:1.24/nginx: NGINX: Denial of
    Service due to memory corruption via crafted MP4 file


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-6
changelog:
  - Resolves: RHEL-146529 -  CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connections


author: Zdenek Dohnal <zdohnal@redhat.com> - 1:1.24.0-7
changelog:
  - Resolves: RHEL-157889 CVE-2026-32647 nginx:1.24/nginx: NGINX: Denial of
    Service or Code Execution via specially crafted MP4 files
  - Resolves: RHEL-159448 CVE-2026-27651 nginx:1.24/nginx: NGINX: Denial of
    Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-159561 CVE-2026-27654 nginx:1.24/nginx: NGINX: Denial of
    Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159540 CVE-2026-27784 nginx:1.24/nginx: NGINX: Denial of
    Service due to memory corruption via crafted MP4 file


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-23
changelog:
  - Resolves: RHEL-6786 - SSL-errors 0A000126 / NS_NET_ERROR_PARTIAL_TRANSFER
    at nginx with reverse-proxy


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-24
changelog:
  - Resolves: RHEL-84477 - nginx: specially crafted MP4 file may cause
    denial of service (CVE-2024-7347)
  - Resolves: RHEL-85556 - nginx: Memory disclosure in the
    ngx_http_mp4_module (CVE-2022-41742)
  - Resolves: RHEL-91446 - nginx: Memory corruption in the
    ngx_http_mp4_module (CVE-2022-41741)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-24.1
changelog:
  - Resolves: RHEL-146525 - nginx: NGINX: Data injection via man-in-the-middle
    attack on TLS proxied connections (CVE-2026-1642)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-4
changelog:
  - CVE-2026-1642 nginx: NGINX: Data injection via man-in-the-middle attack
    on TLS proxied connections


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-5
changelog:
  - CVE-2026-27654 nginx:1.26/nginx: NGINX: Denial of Service or file
    modification via buffer overflow in ngx_http_dav_module


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-6
changelog:
  - CVE-2026-27784 nginx:1.26/nginx: NGINX: Denial of Service due to memory
    corruption via crafted MP4 file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-7
changelog:
  - CVE-2026-27651 nginx:1.26/nginx: NGINX: Denial of Service via undisclosed
    requests when ngx_mail_auth_http_module is enabled


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.26.3-8
changelog:
  - CVE-2026-32647 nginx:1.26/nginx: NGINX: Denial of Service or Code
    Execution via specially crafted MP4 files


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-24.2
changelog:
  - Resolves: RHEL-159557 - CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - Resolves: RHEL-159536 - CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - Resolves: RHEL-159444 - CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - Resolves: RHEL-157885 - CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-25
changelog:
  - Resolves: RHEL-114935 - Image mode: The dir /var/lib and /var/log
    is not created when updating system in image mode


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.20.1-28
changelog:
  - Resolves: RHEL-146528 - CVE-2026-1642 nginx: NGINX: Data injection via
    man-in-the-middle attack on TLS proxied connection


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:1.20.1-28.1
changelog:
  - RHEL-159560 CVE-2026-27654 nginx: NGINX: Denial of Service or file modification via buffer overflow in ngx_http_dav_module
  - RHEL-159539 CVE-2026-27784 nginx: NGINX: Denial of Service due to memory corruption via crafted MP4 file
  - RHEL-159447 CVE-2026-27651 nginx: NGINX: Denial of Service via undisclosed requests when ngx_mail_auth_http_module is enabled
  - RHEL-157888 CVE-2026-32647 nginx: NGINX: Denial of Service or Code Execution via specially crafted MP4 files


author: Martin Osvald <mosvald@redhat.com> - 3:7.92-5
changelog:
  - Remove obsolete alternatives left behind after leapp upgrade from RHEL8 to RHEL9
    Resolves: RHEL-101161


author: Mingyu Shi <mshi@redhat.com> - 2.2.50-1
changelog:
  - Upgrade to 2.2.50
  - Support MAC referring for VLAN in gen_conf. RHEL-110369
  - Introduce state: ignore for route. RHEL-107130
  - Support PCI address matching in gen_conf. RHEL-110369
  - Support MacSec interface in gen_conf. RHEL-110369


author: Gris Ge <fge@redhat.com> - 2.2.54-1
changelog:
  - Upgrade to 2.2.54.
  - Automatically set HSR port MAC address. RHEL-122171
  - Fix OVSDB query failure on database bigger than 20KiB. RHEL-121992


author: Gris Ge <fge@redhat.com> - 2.2.56-1
changelog:
  - Upgrade to 2.2.56
  - Allow using VRF name to specify route table. RHEL-123541
  - Support OVS-DPDK dpdk-lsc-interrupt in nmstate. RHEL-125052
  - Applying desired state with static DNS with static IP will touch `br-ex` even not mentioned. RHEL-126731
  - Support rightca ipsec option. RHEL-123542


author: Mingyu Shi <mshi@redhat.com> - 2.2.58-1
changelog:
  - Upgrade to 2.2.58
  - vrf: Handle ignore interface when verifying desired state. RHEL-141606
  - alt-name: Remove alt-names when interface marked as absent. RHEL-141602
  - hsr: Automatically disable IP on hsr port. RHEL-141609
  - hsr: add support for configuring "interlink" property. RHEL-141608
  - Support referring interface name using its alternative name. RHEL-141601


author: Tomas Juhasz <tjuhasz@redhat.com> - 1:20.20.2-1
changelog:
  - Update to version 20.20.2
    Patch nghttp2 to version 1.68.1 and disable tests which would fail due to this change.
    Resolves: RHEL-164336
    Fixes:  CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547 CVE-2026-21710


author: Andrei Radchenko <aradchen@redhat.com> - 1:22.22.2-1
changelog:
  - Update to version 22.22.2
  - introduced patch updating deps/nghttp2 to v 1.68.1 for CVE-2026-27135
  - disabled failing tests in nghttp2 due to newer version
  - patch for npm/braces CVE-2026-25547
    Resolves: RHEL-163369
    Fixes: CVE-2026-1528 CVE-2026-2229 CVE-2026-1526 CVE-2026-1525 CVE-2026-27135 CVE-2026-27904 CVE-2026-26996 CVE-2026-25547


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-48
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155823


author: Zoltan Fridrich <zfridric@redhat.com> - 8.7p1-49
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164752
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166249
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166233
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166201
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166217


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-1
changelog:
  - Update to openwsman-2.8.1
    Resolves: RHEL-97643
  - Add libwsman-client.so.4 for backward compatibility
    Related: RHEL-97643


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2.8.1-2
changelog:
  - Support added for post-quantum cryptography
    Resolves: RHEL-127516
  - Fix bogus 'sscg' arguments
    Related: RHEL-118292


author: Joseph Marrero <jmarrero@fedoraproject.org> - 2025.7-1
changelog:
  - Rebase to 2025.7
    Backport https://github.com/ostreedev/ostree/pull/3555
    Resolves: #RHEL-129049


author: Chris Lumens <clumens@redhat.com> - 2.1.10-2
changelog:
  - Handle large timeouts correctly in crm_resource --wait
  - Do not try to connect to subdaemons before they're respawned
  - Don't evict IPC clients as long as they're still processing messages
  - Don't overwhelm the FSA queue with repeated CIB queries
  - Resolves: RHEL-45869
  - Resolves: RHEL-87484
  - Resolves: RHEL-114894


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-119515
  - Canonicalize username when matching a user
    Resolves: RHEL-118372


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
changelog:
  - Enable support for DSA keys
    Resolves: RHEL-127624
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-133959
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-133960


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155824


author: Lauren Chilton <lchilton@redhat.com> - 6.3.7-6
changelog:
  - Backport fix for pmdaopenmetrics metric removal (RHEL-101745)
  - Backport fix for pcp2openmetrics metric hanging (RHEL-106772)
  - Backport fix for atop cpu utilization bug (RHEL-79767)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-683.el9]
changelog:
  - perf amd ibs: Sync arch/x86/include/asm/amd-ibs.h header with the kernel (Michael Petlan) [RHEL-106898]
  - perf test amd ibs: Add sample period unit test (Michael Petlan) [RHEL-106898]
  - perf mem/c2c amd: Add ldlat support (Michael Petlan) [RHEL-106898]
  - perf test: Simplify data symbol test (Michael Petlan) [RHEL-106898]
  - perf test: Add timeout to datasym workload (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Incorporate Zen5 DTLB and PageSize information (Michael Petlan) [RHEL-106898]
  - perf amd ibs: Add Load Latency bits in raw dump (Michael Petlan) [RHEL-106898]
  - ice: dpll: fix rclk pin state get and misplaced header macros (Ivan Vecera) [RHEL-146370]
  - ice: dpll: Support E825-C SyncE and dynamic pin discovery (Ivan Vecera) [RHEL-146370]
  - drivers: Add support for DPLL reference count tracking (Ivan Vecera) [RHEL-146370]
  - redhat: configs: Enable CONFIG_DPLL_REFCNT_TRACKER for debug (Ivan Vecera) [RHEL-146370]
  - dpll: Add reference count tracking support (Ivan Vecera) [RHEL-146370]
  - dpll: Enhance and consolidate reference counting logic (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Add support for mux pin type (Ivan Vecera) [RHEL-146370]
  - dpll: Support dynamic pin index allocation (Ivan Vecera) [RHEL-146370]
  - dpll: Add notifier chain for dpll events (Ivan Vecera) [RHEL-146370]
  - dpll: zl3073x: Associate pin with fwnode handle (Ivan Vecera) [RHEL-146370]
  - dpll: Allow associating dpll pin with a firmware node (Ivan Vecera) [RHEL-146370]
  - perf/x86/amd/uncore: Avoid a false positive warning about snprintf truncation in amd_uncore_umc_ctx_init (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Fix the return value of amd_uncore_df_event_init() on error (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Prevent UMC counters from saturating (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Add parameter to configure hrtimer (Michael Petlan) [RHEL-106948]
  - perf/x86/intel/uncore: Use HRTIMER_MODE_HARD for detecting overflows (Michael Petlan) [RHEL-106948]
  - perf/x86: Switch to use hrtimer_setup() (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Use hrtimer for handling overflows (Michael Petlan) [RHEL-106948]
  - perf/x86/amd/uncore: Remove unused 'struct amd_uncore_ctx::node' member (Michael Petlan) [RHEL-106948]
  - pinctrl: intel: fix build warnings about export.h (David Arcari) [RHEL-130326]
  - pinctrl: intel: drop repeated config dependency (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: copy communities using devm_kmemdup_array() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Fix wrong bypass assignment in intel_pinctrl_probe_pwm() (David Arcari) [RHEL-130326]
  - pinctrl: intel: Import PWM_LPSS namespace for devm_pwm_lpss_probe() (David Arcari) [RHEL-130326]
  - pinctrl: baytrail: Use dedicated helpers for chained IRQ handlers (David Arcari) [RHEL-130326]
  - pinctrl: elkhartlake: Add support for DSW community (David Arcari) [RHEL-130326]
  - pinctrl: intel: Add a human readable decoder for pull bias values (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: Add Panther Lake to the list of supported (David Arcari) [RHEL-130326]
  - pinctrl: intel: platform: use semicolon instead of comma in ncommunities assignment (David Arcari) [RHEL-130326]
  - pinctrl: amd: Clear GPIO debounce for suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Constify pointers to 'pinctrl_desc' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix hibernation support with CONFIG_SUSPEND unset (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix use of undeclared identifier 'pinctrl_amd_s2idle_dev_ops' (David Arcari) [RHEL-130338]
  - pinctrl: amd: Add an LPS0 check() callback (David Arcari) [RHEL-130338]
  - pinctrl: Use str_enable_disable-like helpers [partial] (David Arcari) [RHEL-130338]
  - pinctrl: amd: Take suspend type into consideration which pins are non-wake (David Arcari) [RHEL-130338]
  - pinctrl: amd: Fix two small typos (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask non-wake source pins with interrupt enabled at suspend (David Arcari) [RHEL-130338]
  - pinctrl: amd: Convert to platform remove callback returning void (David Arcari) [RHEL-130338]
  - pinctrl: amd: Mask wake bits on probe again (David Arcari) [RHEL-130338]
  - idpf: Fix data race in idpf_net_dim (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: read lower clock bits inside the time sandwich (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: ixgbe: migrate to new RXFH callbacks (Michal Schmidt) [RHEL-139535]
  - idpf: Fix error handling in idpf_vport_open() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL ptr issue after soft reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT configuration on down interfaces (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: Fix RSS LUT NULL pointer crash on early ethtool operations (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix issue with ethtool -n command display (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak of flow steer list on rmmod (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: detach and close netdevs while handling a reset (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use desc_ring when checking completion queue DMA allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: convert vport state to bitmap (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vc_core_deinit() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix LAN memory regions command on some NVMs (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix irdma_alloc_ucontext_resp padding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Fix SRQ shadow area address initialization (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove doorbell elision logic (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Do not set IBK_LOCAL_DMA_LKEY for GEN3+ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add missing mutex destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SIGBUS in AEQ destroy (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add a missing kfree of struct irdma_pci_f for GEN2 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Remove unused CQ registry (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Take a lock before moving SRQ tail in poll_cq (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: depend on DEBUG_FS when building LIBIE_FWLOG (Michal Schmidt) [RHEL-122275 RHEL-139535]
  - RDMA/irdma: CQ size and shadow update changes for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix vf_id size to u16 to avoid overflow (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix positive vs negative error codes in irdma_post_send() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend CQE Error and Flush Handling for GEN3 Devices (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add Atomic Operations support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Restrict Memory Window and CQE Timestamping to GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add SRQ support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Support 64-byte CQEs and GEN3 CQE opcode decoding (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add support for V2 HMC resource management scheme (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Extend QP context programming for GEN3 (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 virtual QP1 support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Introduce GEN3 vPort driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 HW statistics support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 support for AEQ and CEQ (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 CQP support with deferred completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Discover and set up GEN3 hardware register layout (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Add GEN3 core driver support (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Refactor GEN2 auxiliary driver (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fwlog support for e610 (Michal Schmidt) [RHEL-139535]
  - i40e: fix Jumbo Frame support after iPXE boot (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie_aq_str (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: use libie adminq descriptors (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ixgbe: use libie adminq descriptors (Michal Schmidt) [RHEL-139535]
  - idpf: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: add flow steering support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement get LAN MMIO memory regions (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - resource: Add resource set range and size helpers (Michal Schmidt) [RHEL-139535]
  - i40e: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - ice, irdma: fix an off by one in error handling code (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ice: use napi's irq affinity and rmap IRQ notifiers (Michal Schmidt) [RHEL-139535]
  - net: intel: implement modern PM ops declarations [e100,e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - net: adopt skb_network_offset() and similar helpers [i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix aux device unplugging when rdma is not supported by vport (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: cap maximum Rx buffer size (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix error handling in the init_task on load (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix memory leak in idpf_vport_rel() (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: keep the netdev when a reset fails (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: fix OOB in e1000_tbi_should_accept() (Michal Schmidt) [RHEL-139535] {CVE-2025-71093}
  - idpf: reduce mbx_task schedule delay to 300us (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: avoid invalid read in irdma_net_event (Michal Schmidt) [RHEL-139535 RHEL-97658] {CVE-2025-71133}
  - i40e: validate ring_len parameter against hardware-specific values (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: fix scheduling in set_rx_mode (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: correct queue index in Rx allocation error messages (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ixgbe: avoid redundant call to ixgbe_non_sfp_link_config() (Michal Schmidt) [RHEL-139535]
  - e1000e: Remove unneeded checks (Michal Schmidt) [RHEL-139535]
  - ixgbevf: ixgbevf_q_vector clean up (Michal Schmidt) [RHEL-139535]
  - fm10k: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ixgbevf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - ice: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535]
  - iavf: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - i40e: extract GRXRINGS from .get_rxnfc (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Do not directly rely on IB_PD_UNSAFE_GLOBAL_RKEY (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_free_pble (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix data race in irdma_sc_ccq_arm (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: delete a stray tab (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: fix possible vport_config NULL pointer deref in remove (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-68213}
  - net: ixgbe: convert to use .get_rx_ring_count (Michal Schmidt) [RHEL-139535]
  - RDMA/irdma: Remove redundant NULL check of udata in irdma_create_user_ah() (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - i40e: support generic devlink param "max_mac_per_vf" (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for IDPF PCI programming interface (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Silently consume unsignaled completions (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Initialize cqp_cmds_info to prevent resource leaks (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Enforce local fence for LOCAL_INV WRs (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - ixgbe: fix typos in ixgbe driver comments (Michal Schmidt) [RHEL-139535]
  - idpf: remove duplicate defines in IDPF_CAP_RSS (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: avoid redundant VF link state updates (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Set irdma_cq cq_num field during CQ create (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - RDMA/irdma: Fix SD index calculation (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: cleanup remaining SKBs in PTP flows (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-40175}
  - idpf: fix mismatched free function for dma_alloc_coherent (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA/irdma: Remove unused struct irdma_cq fields (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - net: intel: fm10k: Fix parameter idx set but not used (Michal Schmidt) [RHEL-139535]
  - idpf: add HW timestamping statistics (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - i40e: improve VF MAC filters accounting (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - RDMA/irdma: Update Kconfig (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - libie: fix linking with libie_{adminq,fwlog} when CONFIG_LIBIE=n (Michal Schmidt) [RHEL-139535]
  - i40e: remove redundant memory barrier when cleaning Tx descs (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for nointerrupt queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove SW marker handling from NAPI (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add 4-byte completion descriptor definition (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: link NAPIs to queues (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: use a saner limit for default number of queues to allocate (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: fix Rx descriptor ready check barrier in splitq (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - e1000: drop unnecessary constant casts to u16 (Michal Schmidt) [RHEL-139535]
  - i40e: Fix potential invalid access when MAC list is empty (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39853}
  - i40e: remove read access to debugfs files (Michal Schmidt) [RHEL-139535 RHEL-97688] {CVE-2025-39901}
  - idpf: fix UAF in RDMA core aux dev deinitialization (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: do not linearize big TSO packets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove obsolete stashing code (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: stop Tx if there are insufficient buffer resources (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: replace flow scheduling buffer ring with buffer pool (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: simplify and fix splitq Tx packet rollback error path (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: improve when to set RE bit logic (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add support for Tx refillqs in flow scheduling mode (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - eth: intel: use vmalloc_array() to simplify code [fm10k] (Michal Schmidt) [RHEL-139535]
  - idpf: preserve coalescing settings across resets (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add cross timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl2: rename enum virtchnl2_cap_rss (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - ethernet: intel: fix building with large NR_CPUS [fm10k,i40e] (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: implement IDC vport aux driver MTU change handler (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement remaining IDC RDMA core callbacks and handlers (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: implement RDMA vport auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: implement core RDMA auxiliary dev create, init, and destroy (Michal Schmidt) [RHEL-139535 RHEL-97658 RHEL-99644]
  - idpf: use reserved RDMA vectors from control plane (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: return 0 size for RSS key if not supported (Michal Schmidt) [RHEL-139535 RHEL-99644] {CVE-2025-38402}
  - e1000: Move cancel_work_sync to avoid deadlock (Michal Schmidt) [RHEL-139535] {CVE-2025-38114}
  - i40e: retry VFLR handling if there is ongoing VF reset (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - i40e: return false from i40e_reset_vf if reset is in progress (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - iavf: convert to NAPI IRQ affinity API (Michal Schmidt) [RHEL-139535 RHEL-97703]
  - ice: add ice driver PTP pin documentation (Michal Schmidt) [RHEL-139535]
  - i40e: add link_down_events statistic (Michal Schmidt) [RHEL-139535 RHEL-97688]
  - idpf: add support for Rx timestamping (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp flows (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add Tx timestamp capabilities negotiation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add PTP clock configuration (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add mailbox access to read PTP clock time (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: negotiate PTP capabilities and get PTP clock (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: move virtchnl structures to the header file (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - virtchnl: add PTP virtchnl definitions (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: add initial PTP support (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: change the method for mailbox workqueue allocation (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: remove unreachable code from setting mailbox (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - idpf: assign extracted ptype to struct libeth_rqe_info field (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - RDMA: Don't use %pK through printk (Michal Schmidt) [RHEL-139535 RHEL-97658]
  - idpf: use napi's irq affinity (Michal Schmidt) [RHEL-139535 RHEL-99644]
  - intel/fm10k: Remove unused fm10k_iov_msg_mac_vlan_pf (Michal Schmidt) [RHEL-139535]
  - e1000: Hold RTNL when e1000_down can be called (Michal Schmidt) [RHEL-139535]
  - e1000: Link NAPI instances to queues and IRQs (Michal Schmidt) [RHEL-139535]
  - net: handle HAS_IOPORT dependencies [intel] (Michal Schmidt) [RHEL-139535]
  - intel: make module parameters readable in sys filesystem [e100] (Michal Schmidt) [RHEL-139535]
  - intel: add bit macro includes where needed [e1000,fm10k] (Michal Schmidt) [RHEL-139535]
  - ice: add documentation for FW logging (Michal Schmidt) [RHEL-139535]
  - i40e: Annotate struct i40e_qvlist_info with __counted_by (Michal Schmidt) [RHEL-139535]
  - fm10k: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e1000: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - e100: replace deprecated strncpy with strscpy (Michal Schmidt) [RHEL-139535]
  - net: e1000: Remove unused declarations (Michal Schmidt) [RHEL-139535]
  - Documentation/eth/intel: Remove references to SourceForge (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - Documentation/eth/intel: Update address for driver support (Michal Schmidt) [RHEL-139535 RHEL-97688 RHEL-97703]
  - ixgb: Remove ixgb driver (Michal Schmidt) [RHEL-139535]
  - ice: Fix broken link in ice NAPI doc (Michal Schmidt) [RHEL-139535]
  - e100: Fix possible use after free in e100_xmit_prepare (Michal Schmidt) [RHEL-139535] {CVE-2022-49026}
  - fm10k: Fix error handling in fm10k_init_module() (Michal Schmidt) [RHEL-139535]
  - e1000: Remove unnecessary use of kmap_atomic() (Michal Schmidt) [RHEL-139535]
  - intel/fm10k:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - intel/e1000:fix repeated words in comments (Michal Schmidt) [RHEL-139535]
  - fm10k: remove unexpected word "the" (Michal Schmidt) [RHEL-139535]
  - intel: remove unused macros [e100,e1000,ixgb] (Michal Schmidt) [RHEL-139535]
  - ixgb: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - e1000: Fix typos in comments (Michal Schmidt) [RHEL-139535]
  - i40e: remove enum i40e_client_state (Michal Schmidt) [RHEL-139535]
  - ixgb: Remove useless DMA-32 fallback configuration (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_build_skb() (Michal Schmidt) [RHEL-139535]
  - e1000: switch to napi_consume_skb() (Michal Schmidt) [RHEL-139535]
  - fm10k: Fix syntax errors in comments (Michal Schmidt) [RHEL-139535]
  - e100: fix device suspend/resume (Michal Schmidt) [RHEL-139535]
  - ethernet: ixgb: use eth_hw_addr_set() (Michal Schmidt) [RHEL-139535]
  - ethernet: constify references to netdev->dev_addr in drivers [ixgb] (Michal Schmidt) [RHEL-139535]
  - ethernet: use eth_hw_addr_set() for dev->addr_len cases [intel] (Michal Schmidt) [RHEL-139535]
  - e100: fix buffer overrun in e100_get_regs (Michal Schmidt) [RHEL-139535]
  - e100: fix length calculation in e100_get_regs_len (Michal Schmidt) [RHEL-139535]
  - Doc: networking: Fox a typo in ice.rst (Michal Schmidt) [RHEL-139535]
  - e100: Avoid memcpy() over-reading of ETH_SS_STATS (Michal Schmidt) [RHEL-139535]
  - wifi: ath12k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - wifi: ath11k: workaround to use VMs (Jose Ignacio Tornos Martinez) [RHEL-141399]
  - ALSA: update RHEL kconfigs for 6.18 upstream code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: properly initialize speaker_id for TAS2563 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix micmute LED reversed on HP Abe and Bantie (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: qdsp6: q6asm-dai: set 10 ms period and buffer alignment. (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6adm: the the copp device only during last instance (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6asm-dai: perform correct state check before closing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: q6apm-dai: set flags to reflect correct operation of appl_ptr (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sdw: fix memory leak for sdw_stream_runtime (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-tx-macro: fix SM6115 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: fix regmap leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: remove the reset operation in probe and remove (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-mixer: us16x08: validate meter packet indices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcmcia: Fix resource leak in snd_pdacf_probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Constrain sample rates from audio PLLs only in master mode (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for Lenovo platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: fix mute/micmute LEDs don't work for HP 200 G2i (Jaroslav Kysela) [RHEL-118911]
  - ALSA: realtek/alc288 fix headphone for MS Surface 2/3 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Add new quirks for PTL on Dell with CS42L43 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add Asus quirk for TAS amplifiers (Jaroslav Kysela) [RHEL-118911]
  - regmap: slimbus: fix bus_context pointer in regmap init calls (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40317}
  - ASoC: ops: fix snd_soc_get_volsw for sx controls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: support Q7.8 volume format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Always return 0 when a subsystem ID is found (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: Fix error handling in wcd937x codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Convert FLOAT to S32 during blob selection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Prefer 32-bit DMIC blobs for 8-bit formats as well (Jaroslav Kysela) [RHEL-118911]
  - slimbus: ngd: Fix reference count leak in qcom_slim_ngd_notify_slaves (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Remove duplicated module macros (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Fix integer overflow in sample size validation (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68344}
  - ALSA: wavefront: Clear substream pointers on close (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_hda_read_acpi() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68345}
  - ALSA: hda/tas2781: fix speaker id retrieval for multiple probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add match for ASUS Xbox Ally projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dice: fix buffer overflow in detect_stream_formats() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68346}
  - ASoC: amd: acp: update tdm channels for specific DAI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: add bounds check in put_user loop for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68753}
  - ALSA: uapi: Fix typo in asound.h comment (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire-motu: fix buffer overflow in hwdep read for DSP events (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68347}
  - ASoC: ak5558: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ak4458: Disable regulator when error happens (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Audio is not resuming after s0ix (Jaroslav Kysela) [RHEL-118911]
  - ASoC: bcm: bcm63xx-pcm-whistler: Check return value of of_dma_configure() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: catpt: Fix error path in hw_params() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_xcvr: clear the channel status control memory (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: add missing build config (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: nau8325: Silence uninitialized variables warnings (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8325: use simple i2c probe function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: correct the wrong period (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong chip ID for reset variable check (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SDCA: Fix missing dash in HIDE DisCo property (Jaroslav Kysela) [RHEL-118911]
  - soundwire: intel_auxdevice: add cs42l45 codec to wake_capable_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED for HP ZBook X G2i platform (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek - Enable Mute LED and Tas2781 for HP platform (Jaroslav Kysela) [RHEL-118911]
  - platform/x86: serial-multi-instantiate: Add IRQ_RESOURCE_OPT for IRQ missing projects (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP ProBook 450 G8 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix uac2 clock source at terminal parser (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: add quirk for HP pavilion aero laptop 13z-be200 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cirrus fix cs420x MacPro 6,1 inverted jack detection (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add DSD quirk for LEAK Stereo 230 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: au88x0: Fix incorrect error handling for PCI config reads (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add native DSD quirks for PureAudio DAC series (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Correct the wrong project ID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer dereference in snd_usb_mixer_controls_badd (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40275}
  - ASoC: SDCA: bug fix while parsing mipi-sdca-control-cn-list (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68281}
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40269}
  - ALSA: hda/tas2781: Add new quirk for HP new projects (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: fix getting the wrong device number (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: va-macro: fix resource leak in probe error path (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2783A: Fix issues in firmware parsing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: fix device reference leak in is_sdca_endpoint_present() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs4271: Fix regulator leak on probe failure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Fix breakage at probing nvhdmi-mcp driver (Jaroslav Kysela) [RHEL-118911] {CVE-2025-68205}
  - ASoC: da7213: Use component driver suspend/resume (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add min_mute quirk for SteelSeries Arctis (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: cs35l56: Update firmware filename description for B0 silicon (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Enable mic on Vaio RPL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: pm4125-sdw: correct number of soundwire ports (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: Fix sync error in consumer mode (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Fix build for sdw_utils (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Victus 15-fa1xxx (MB 8C2D) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: fix prepare clock stop failed (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't log messages meant for 1810c when initializing 1824c (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_micfil: correct the endian format for DSD (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl_sai: fix bit order for DSD format (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Use snd_codec format when initializing probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Disable periods-elapsed work when closing PCM (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40344}
  - ASoC: Intel: avs: Unprepare a stream when XRUN occurs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add name_prefix for rt1321 part id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qdsp6: q6asm: do not sleep while atomic (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: soc-acpi-intel-ptl-match: Remove cs42l43 match from sdw link3 (Jaroslav Kysela) [RHEL-118911]
  - ASOC: max98090/91: fix for filter configuration: AHPF removed DMIC2_HPF added (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Add ACP7.0 match entries for cs35l56 and cs42l43 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Fix missing include of kunit/test-bug.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix control pipe direction (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for Lenovo Yoga 7 2-in-1 14AKP10 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Fix mute led for HP Omen 17-cb0xxx (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix vendor quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add volume quirks for MS LifeChat LX-3000 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd/sdw_utils: avoid NULL deref when devm_kasprintf() fails (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40162}
  - ASoC: max98090/91: fixed max98091 ALSA widget powering up/down (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x-sdw: remove redundant runtime pm calls (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sdw_utils: add rt1321 part id to codec_info_list (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Fix NULL pointer deference in try_to_register_card (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40085}
  - ALSA: firewire: amdtp-stream: fix enum kernel-doc warnings (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add mixer_playback_min_mute quirk for Logitech H390 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Avoid unnecessary blocking in IRQ handler (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Add DMI quirk to bypass jack debounce circuit (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Consistently clear interrupts before unmasking (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Generalize helper to clear IRQ status (Jaroslav Kysela) [RHEL-118911]
  - ASoC: nau8821: Cancel jdet_work before handling jack ejection (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: Fix gain setting ranges for Renesas IDT821034 codec (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Update ti,tas2781.yaml for adding tas58xx (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Support more newly-released amplifiers tas58xx in the driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: Add support for QCS615 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,sm8250: Add QCS615 sound card (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Set tas2781_hda::tasdevice_priv::chip_id as TAS5825 in case of tas5825 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk entry for HP ZBook 17 G6 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for Huawei Technologies Co., Ltd. CM-Q3 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Add MSI X870E Tomahawk to denylist (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix missing pointer check in hda_component_manager_init function (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40097}
  - ALSA: hda: cs35l41: Fix NULL pointer dereference in cs35l41_get_acpi_mute_state() (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40098}
  - ASoC: rt722: add settings for rt722VB (Jaroslav Kysela) [RHEL-118911]
  - ASoC: meson: aiu-encoder-i2s: fix bit clock polarity (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fpc: replace kmalloc_array followed by copy_from_user with memdup_array_user (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Enable init_profile_id for device initialization (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Fix typo in docs (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for ASUS ROG Zephyrus Duo (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: Read the LLP via the associated Link DMA channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: do not report invalid delay values (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-audio: add dev_dbg_ratelimited wrapper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: hda-pcm: Place the constraint on period time instead of buffer time (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Account for different ChainDMA host buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Correct the minimum host DMA buffer size (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-topology: Fix multi-core and static pipelines tear down (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Remove IRQ masking in suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: cs42l43: Move IRQ enable/disable to encompass force suspend (Jaroslav Kysela) [RHEL-118911]
  - mfd: arizona: Make legacy gpiolib interface optional (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Add pin fix for HP ProDesk model (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't hardcode gain for output channel of Presonus Studio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add the initial mix for Presonus Studio 1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: doc: improved docs about quirk_flags in snd-usb-audio (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: make param quirk_flags change-able in runtime (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: improve module param quirk_flags (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add two-way convert between name and bit for QUIRK_FLAG_* (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: fix race condition to UAF in snd_usbmidi_free (Jaroslav Kysela) [RHEL-118911] {CVE-2025-39997}
  - ALSA: usb-audio: add mono main switch to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: document 'chan_map' member in snd_dec_opus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Set fw_regs table after getting REVID (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Add quirk for HP Spectre 14t-ea100 (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix an error code in probe() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic3x: Fix class-D initialization for tlv320aic3007 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: stm32: sai: manage context in set_sysclk callback (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: fix signedness bug in wcd_dt_parse_micbias_info() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert MediaTek mt8183-mt6358 to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Convert MT8183 DA7219 sound card to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-binding: Convert mt8183-afe-pcm to dt-schema (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Fix spelling mistake "Perifpheral" -> "Peripheral" (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Remove unneeded semicolon (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wcd934x: fix error handling in wcd934x_codec_parse_data() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: don't apply interface quirk to Presonus S1824c (Jaroslav Kysela) [RHEL-118911]
  - tas2783A: Add acpi match changes for Intel MTL (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: add machine driver changes (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: machine driver amp utility for TI devices (Jaroslav Kysela) [RHEL-118911]
  - ASoc: tas2783A: Add soundwire based codec driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: ops: improve snd_soc_get_volsw (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l41: Fallback to reading Subsystem ID property if not ACPI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Correct the wrong description and register address on tas2781 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sof_sdw: Prevent jump to NULL add_sidecar callback (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40132}
  - ASoC: qcom: qdsp6/audioreach: add support for offloading raw opus playback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: increase SNDRV_COMPRESS_VERSION minor version by 1 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress: add raw opus codec define and opus decoder structs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Drop struct qmc_dai_chan (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Only request completion on last channel (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: fsl_qmc_audio: Ensure audio channels are ordered in TDM bus (Jaroslav Kysela) [RHEL-118911]
  - ASoC: da7213: Convert to DEFINE_RUNTIME_DEV_PM_OPS() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: sc8280xp: explicitly set S16LE format in sc8280xp_be_hw_params_fixup() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc3-dtrace: fix potential integer overflow in allocation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd938x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move status_update callback to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd939x: get regmap directly (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move component ops to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd-common: move WCD_SDW_CH to common (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd: add common helper for wcd codecs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcdxxxx: use of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add sdw_slave_get_current_bank helper (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: add of_sdw_find_device_by_node helper (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: make stub functions inline (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wcd937x: set the comp soundwire port correctly (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40045}
  - ASoC: soc-dapm: add snd_soc_dapm_set_idle_bias() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step2 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: tidyup idle_bias handling - step1 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: remove suspend_bias_off from snd_soc_dapm_context (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-card: add snd_soc_card_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: add snd_soc_component_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: use dapm->component instead of container_of() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_card() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: add snd_soc_dapm_to_dev() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Fix KCSAN data-race warning at snd_seq_fifo_poll_wait() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: spi/at73c213: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: add bindings for pm4125 audio codec (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: Disable bottom softirqs as part of spin_lock_irq() on PREEMPT_RT (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40142}
  - ASoC: Intel: hda-sdw-bpt: set persistent_buffer false (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-generic: remove shared static buffer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: asihpi: Simplify error handling in PCM substream setup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: apple: mca: Add "apple,t8103-mca" compatible (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Remove redundant size arguments from strscpy() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: pcm1754: add pcm1754 dac driver (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,pcm1754: add binding documentation (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/dbri: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/cs4231: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc/amd7930: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: fcp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: fix scoped_guard done variable misuse (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ppc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd_ps3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: parisc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: snd-n64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sgio2audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: arm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Don't split string across lines (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add test for getting cal data from HP EFI (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add HP-specific EFI variable for calibration data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib-test: Add tests for cs_amp_get_vendor_spkid() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs35l56: Check for vendor-specific speaker ID value (Jaroslav Kysela) [RHEL-118911]
  - efi: Add EFI_ACCESS_DENIED status code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Add handling for Lenovo and HP UEFI speaker ID (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs-amp-lib: Rename defines for Cirrus Logic EFI (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hrtimer: Avoid direct access to hrtimer clockbase (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add tas2118, tas2x20, tas5825 support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40121}
  - ASoC: Intel: bytcht_es8316: Fix invalid quirk input mapping (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Add default value for burst_bclkdiv (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: tlv320dac33: Remove unused struct tlv320dac33_platform_data and header file tlv320dac33-plat.h (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_AVAIL64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add SNDRV_COMPRESS_TSTAMP64 ioctl (Jaroslav Kysela) [RHEL-118911]
  - ALSA: compress_offload: Add 64-bit safe timestamp infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: scarlett2: Add Vocaster speaker/headphone mute controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Send the PCM period elapsed notification properly (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply quirk for MOONDROP Quark2 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: apply "mixer_min_mute" quirks on some devices (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: add quirk QUIRK_FLAG_MIXER_CAPTURE_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: rename QUIRK_FLAG_MIXER_MIN_MUTE to QUIRK_FLAG_MIXER_PLAYBACK_MIN_MUTE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Shutdown jack detection on suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Disable IRQs in system suspend (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Store IRQ domain in codec private data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs42l43: Rename system suspend callback and fix debug print (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: wlf,wm8960: Document routing strings (pin names) (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-wsa-macro: add Codev version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: lpass-macro: add Codec version 2.9 (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: add compatible for glymur SoC (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: x1e80100: set card driver name from match data (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: ssm4567: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5682: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5663: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt5514: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt298: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt286: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: rt274: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: probe: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: nau8825: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98927: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98373: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: max98357a: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: i2stest: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: es8336: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: dmic: Refactor dai_link creation (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: da7219: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: hda: Adjust platform name (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/conexant: Fix typos in comments (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Fix serialization in snd_rme32_capture_adat_open() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rockchip: i2s-tdm: switch to FIELD_PREP_WM16_CONST macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Fix a less than zero check on a u32 (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use is_s4_resume() macro (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: topology: convert to cpu endainess type before accessing (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix potential null pointer dereference (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40013}
  - soundwire: Use min() to improve code (Jaroslav Kysela) [RHEL-118911]
  - soundwire: bus: Drop dev_pm_domain_detach() call (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_kcontrol_component() to snd_soc_kcontrol_to_component() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename dapm_kcontrol_get_value() to snd_soc_dapm_kcontrol_get_value() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_dapm() to snd_soc_dapm_kcontrol_to_dapm() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: rename snd_soc_dapm_kcontrol_widget() to snd_soc_dapm_kcontrol_to_widget() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: misc: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: virtio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97bus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atmel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pxa2xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aaci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aoa: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sparc: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vxpocket: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pdaudiocf: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: at73c213: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: xen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: x86: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for preset locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: synth: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: i2c: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: caiaq: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bcd2000: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: qcom: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: line6: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hiface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usx2y: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ua101: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: serial-u16550: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: portman2x4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mts64: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mtpav: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mpu401: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: dummy: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl4: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aloop: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wavefront: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: wss: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sscape: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu8000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sb: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opti9xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: opl3sa2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: msnd: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: gus: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es18xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1688: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs423x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmi8330: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1816a: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ymfpci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: vx222: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: via82xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: trident: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sonicvibes: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: sis7019: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme9652: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdspm: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hdsp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme96: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: rme32: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcxhr: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: oxygen: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: nm256: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: mixart: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: maestro3: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx6464es: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lola: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: korg1212: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: intel8x0: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ice1712: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: fm801: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1968: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: es1938: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for emu1010 FPGA locking (Jaroslav Kysela) [RHEL-118911]
  - ALSA: emu10k1: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: echoaudio: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ctxfi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs5535audio: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs46xx: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cs4281: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: cmipci: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ca0106: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: bt87x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: aw2: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: atiixp: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ad1889: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als4000: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: als300: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ens137x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: azt3328: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ali5451: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: ac97: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: lib: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: isight: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireface: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: tascam: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: oxfw: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: motu: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: fireworks: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: digi00x: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: dice: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: firewire: bebob: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: sof: ipc4-topology: Add support to sched_domain attribute (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Introduce sof_client_dev_entry structure (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Convert sof_client_dev_to_sof_dev into function (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes: Add available points_info(), IPC4 only (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Human readable debugfs "probe_points" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client: Add sof_client_ipc4_find_swidget_by_id() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: IPC4: Add GET macros for module id and module instance id (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: sof-client-probes-ipc4: Implement ipc4_probes_points_info (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for float sample type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-topology: Add support for 8-bit formats (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: ipc4-pcm: Add fixup for channels (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/rw: Cleanup with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/synth: Clean up with guard and auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss/midi: Cleanup with guard and auto-cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: oss: Clean up core code with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up fifo locking with guard (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up queue locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up port locking with auto cleanup (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use auto-cleanup for client refcounting (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Use guard() for mutex and rwsem locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Clean up spin lock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: seq: Simplify internal command operation from OSS layer (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ext: Use guard() for spinlocks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use auto cleanup for temporary buffers (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/intel: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/analog: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/generic: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/component: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs8409: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/tas2781: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/cs35l41: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use guard() for mutex locks and COEF locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/core: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use guard() for mutex locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use auto cleanup macros for DSP loader locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/common: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/realtek: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/hdmi: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda/ca0132: Use cleanup macros for PM controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Introduce auto cleanup macros for PM (Jaroslav Kysela) [RHEL-118911]
  - ASoC: doc: Internally link to Writing an ALSA Driver docs (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: only detect codecs when HDA DSP probe (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: Intel: split codec mask detect and programming UNSOL (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: acp: Remove (explicitly) unused header (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: adau1977: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: amd: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Simplify dmi_match_quirk() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: lx_core: use int type to store negative error codes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: pcm: oss: Use guard() for spin locks (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fixes for handshake, MIDI out and cleanup (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tlv320aic32x4: use dev_err_probe() for regulators (Jaroslav Kysela) [RHEL-118911]
  - ASoC: imx-hdmi: remove cpu_pdev related code (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add validation of UAC2/UAC3 effect units (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: omap-twl4030: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: ti,twl4030-audio: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: test-component: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fsl: Use kcalloc() instead of kzalloc() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Fix null-deref in tascam_midi_in_urb_complete() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for SMECNS module (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: sort modules based on hex ids (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: fix typos in I2S_INTF_TYPE (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add support for static calibration (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: add documentation for i2s interface type (Jaroslav Kysela) [RHEL-118911]
  - ASoC: qcom: audioreach: deprecate AR_TKN_U32_MODULE_[IN/OUT]_PORTS (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Use le16_to_cpu() for product ID comparison (Jaroslav Kysela) [RHEL-118911]
  - ASoC: codecs: wsa883x: Handle shared reset GPIO for WSA883x speakers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: qcom,wsa8830: Add reset-gpios for shared line (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Do not share the name pointer between components (Jaroslav Kysela) [RHEL-118911] {CVE-2025-40338}
  - ASoC: Intel: avs: Drop pcm.h dependency for probes (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add infrastructure for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add deep sleep command (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add MIDI support and mixer controls (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio capture and decoding (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Implement audio playback and feedback (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: us144mkii: Add PCM core infrastructure (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Add initial driver for TASCAM US-144MKII (Jaroslav Kysela) [RHEL-118911]
  - ASoC: wl1273: Remove (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt1321: Add RT1321 amplifier support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in print_device_list() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Use min() to simplify snd_hda_get_devices() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: sst: Remove redundant semicolons (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Improve local variable data type in snd_hda_get_num_devices() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Use auto-cleanup for shutdown locks (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Convert brcm,bcm2835-i2s to DT schema (Jaroslav Kysela) [RHEL-118911]
  - soundwire: debugfs: add SCP_SDCA_IntStatX and SCP_SDCA_IntMaskX registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: realtek,alc5623: convert to DT schema (Jaroslav Kysela) [RHEL-118911]
  - ASoC: fix "dependant"->"dependent" (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb-audio: Replace manual mutex/spinlock with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: 6fire: Clean ups with guard() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: usb: scarlett2: Clean ups with guard() and __free() (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Add TAS5825 support (Jaroslav Kysela) [RHEL-118911]
  - ALSA: hda: Fix spelling mistake "dismatch" -> "mismatch" (Jaroslav Kysela) [RHEL-118911]
  - ASoC: cs48l32: Use PTR_ERR_OR_ZERO() to simplify code (Jaroslav Kysela) [RHEL-118911]
  - ASoC: rt721: add some vendor registers (Jaroslav Kysela) [RHEL-118911]
  - ASoC: SOF: imx: Remove error print for devm_add_action_or_reset() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: tas2781: Add keyword "init" in profile section (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dmaengine_pcm: Add port_window_size to DAI dma data struct (Jaroslav Kysela) [RHEL-118911]
  - ASoC: dt-bindings: Drop imx-audio-sgtl5000.txt (Jaroslav Kysela) [RHEL-118911]
  - ASoC: pxa: add GPIOLIB_LEGACY dependency (Jaroslav Kysela) [RHEL-118911]
  - ASoC: add GPIOLIB_LEGACY dependency where needed (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_init_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_get_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-component: unpack snd_soc_component_force_bias_level() (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_init_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: soc-dapm: move snd_soc_dapm_get_bias_level() to soc-dpcm (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Conditional-path support (Jaroslav Kysela) [RHEL-118911]
  - ASoC: Intel: avs: Parse conditional path tuples (Jaroslav Kysela) [RHEL-118911]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-684.el9]
changelog:
  - new config in drivers/phy (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix PTP for VSC8574 and VSC8572 (Izabela Bakollari) [RHEL-121401]
  - r8169: make Kconfig option for LED support user-visible (Izabela Bakollari) [RHEL-121401]
  - net: phy: use new iterator mdiobus_for_each_phy in mdiobus_prevent_c45_scan (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: simplify return in ksz9477_phy_errata() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: remove old sfp_parse_* functions (Izabela Bakollari) [RHEL-121401]
  - net: sfp: convert sfp quirks to modify struct sfp_module_support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: pre-parse the module support (Izabela Bakollari) [RHEL-121401]
  - of: mdio: warn if deprecated fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: fix duplex setting error for phy leds (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix clk warning when removing the driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove irq argument from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: let fixed_phy_unregister free the phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: enable serdes option mode for RTL8226-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix RTL8211F wake-on-lan support (Izabela Bakollari) [RHEL-121401]
  - net: mdiobus: release reset_gpio in mdiobus_unregister_device() (Izabela Bakollari) [RHEL-121401]
  - phy: micrel: add Signal Quality Indicator (SQI) support for KSZ9477 switch PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: assign default match function for non-PHY MDIO devices (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add cable test support for KSZ9477-class PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add RX error counter support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: add MDI/MDI-X control support for KSZ9477 switch-integrated PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: remove KSZ9477 EEE quirks now handled by phylink (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ9477 PHY issues after suspend/resume (Izabela Bakollari) [RHEL-121401]
  - net: phy: drop phy_settings and the associated lookup helpers (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Dynamically control external clock of KSZ PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: c45: improve handling of disabled EEE modes in generic ethtool functions (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: remove call to devm_hwmon_sanitize_name (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: make HWMON support a user-visible Kconfig symbol (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add hwmon support for temp sensor on RTL822x (Izabela Bakollari) [RHEL-121401]
  - net: sfp: return the number of written bytes for smbus single byte access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: Add power management and soft reset support (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: fix nvmem cell reference leak in mt798x_phy_calibration (Izabela Bakollari) [RHEL-121401]
  - net: sfp: extend Potron XGSPON quirk to cover additional EEPROM variant (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell-88q2xxx: Fix clamped value in mv88q2xxx_hwmon_write (Izabela Bakollari) [RHEL-121401]
  - net: phy: RTL8211FVD: Restore disabling of PHY-mode EEE (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add SQI support for LAN867x Rev.D0 PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add SQI and SQI+ support for OATC14 10Base-T1S PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: implement configurability for SGMII in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: add HW timestamp configuration reporting (Izabela Bakollari) [RHEL-121401]
  - phy: add hwtstamp_get callback to phy drivers (Izabela Bakollari) [RHEL-121401]
  - phy: rename hwtstamp callback to hwtstamp_set (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86252 and MxL86282 (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: add support for MxL86211C (Izabela Bakollari) [RHEL-121401]
  - net: mdio: eliminate kdoc warnings in mdio_device.c and mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix link properties on USXGMII and internal PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-gpy: fix bogus error on USXGMII and integrated PHY (Izabela Bakollari) [RHEL-121401]
  - net: ethtool: Add support for 1600Gbps speed (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Simplify register value passing (Izabela Bakollari) [RHEL-121401]
  - net: phy: adin1100: Fix software power-down ready condition (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_phy_eee() helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr1 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: allow CLKOUT to be disabled on RTL8211F(D)(I)-VD-CG (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate has_phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: eliminate priv->phycr2 variable (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: create rtl8211f_config_rgmii_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add missing supported link modes for the fixed-link (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814: Enable in-band auto-negotiation (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add helper for fixing RGMII PHY mode based on internal mac delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove setting supported/advertised modes from fixed_phy_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Handle devm_phy_package_join() failure in vsc85xx_probe_common() (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Add support for PHY LED control (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Consolidate probe functions into a common helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Simplify LED mode update using phy_modify() (Izabela Bakollari) [RHEL-121401]
  - net: mdio: fix resource leak in mdiobus_register_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8814 fix reset of the QSGMII interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s:: add cable diagnostic support for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: phy-c45: add OATC14 10BASE-T1S PHY cable diagnostic support (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_device members pause and asym_pause bitfield bits (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce internal API for PHY MSE diagnostics (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: lan8842 errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add interrupt support for RTL8221B (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: configure link status control for LAN867x Rev.D0 (Izabela Bakollari) [RHEL-121401]
  - net: phy: microchip_t1s: add support for Microchip LAN867X Rev.D0 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: add iterator mdiobus_for_each_phy (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83869: fix STRAP_OPMODE bitmask (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8531 (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Add RTL8224 cable testing support (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Use PHY_ID_MATCH_EXACT for VSC8584, VSC8582, VSC8575, VSC856X (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83867: Disable EEE support as not implemented (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed wake-on-lan PHY speed control (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink managed MAC Wake-on-Lan support (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_may_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_can_wakeup() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: always set shared->phydev for LAN8814 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix typos in comments (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: fix rtl8221b-vm-cg name (Izabela Bakollari) [RHEL-121401]
  - net: mdio: use macro module_driver to avoid boilerplate code (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: Avoid PHYCR2 access if PHYCR2 not present (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: Fix GMII/MII/MII-Lite selection (Izabela Bakollari) [RHEL-121401]
  - net: doc: Fix typos in docs (Izabela Bakollari) [RHEL-121401]
  - net: sfp: don't include swphy.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: annotate linkmode initializers as not used after init phase (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_unregister (Izabela Bakollari) [RHEL-121401]
  - docs: networking: phy: clarify abbreviation "PAL" (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix lan8814_config_init (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Fix default LED behaviour (Izabela Bakollari) [RHEL-121401]
  - net: phy: stop exporting phy_driver_register (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83640: improve phydev and driver removal handling (Izabela Bakollari) [RHEL-121401]
  - net: phy: ax88796b: Replace hard-coded values with PHY_ID_MATCH_MODEL() (Izabela Bakollari) [RHEL-121401]
  - net: phy: update all PHYs to use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: use sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: provide sfp_get_module_caps() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_copy() (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: use %pe in print format (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add Fast link failure support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear link parameters on admin link down (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: use bitmap_empty() where appropriate (Izabela Bakollari) [RHEL-121401]
  - net: phylink: warn if deprecated array-style fixed-link binding is used (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear EEE runtime state in PHY_HALTED/PHY_ERROR (Izabela Bakollari) [RHEL-121401]
  - net: phy: broadcom: Convert to phy_id_compare_model() (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_model() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Update Kconfig help text (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: remove two function stubs (Izabela Bakollari) [RHEL-121401]
  - net: phy: marvell: Fix 88e1510 downshift counter errata (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: delete aqr_firmware_read_fingerprint() prototype (Izabela Bakollari) [RHEL-121401]
  - net: phy: NXP_TJA11XX: Update Kconfig with TJA1102 support (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: support phy-mode = "10g-qxgmii" on NXP SPF-30841 (AQR412C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: create and store a 64-bit firmware image fingerprint (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: report and configure in-band autoneg capabilities (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: print global syscfg registers (Izabela Bakollari) [RHEL-121401]
  - net: phy: transfer phy_config_inband() locking responsibility to phylink (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add lock for serializing concurrent pl->phydev writes with resolver (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Stop taking ts_lock for tx_queue and use its own lock (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add PTP support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce function __lan8814_ptp_probe_once (Izabela Bakollari) [RHEL-121401]
  - net: phylink: disable autoneg for interfaces that have no inband (Izabela Bakollari) [RHEL-121401]
  - net: phylink: provide phylink_get_inband_type() (Izabela Bakollari) [RHEL-121401]
  - net: phy: add phy_interface_weight() (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for FLYPRO copper SFP+ module (Izabela Bakollari) [RHEL-121401]
  - net: phy: mtk-2p5ge: Add LED support for MT7988 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: simplify fixed_mdio_read (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: support for TRIGGER_NETDEV_LINK on RTL8211E and RTL8211F (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix when PTP clock is register and unregister (Izabela Bakollari) [RHEL-121401]
  - net: phy: as21xxx: better handle PHY HW reset on soft-reboot (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce phy_id_compare_vendor() PHY ID helper (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for MxL86111 PHY (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: fix indentation in struct phy_driver (Izabela Bakollari) [RHEL-121401]
  - net: phy: mxl-86110: add basic support for led_brightness_set op (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: add support for AQR115 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: promote AQR813 and AQR114C to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename aqr113c_config_init() to aqr_gen4_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reimplement aqcs109_config_init() as aqr_gen2_config_init() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen3_config_init() for AQR112 and AQR412(C) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: call aqr_gen2_fill_interface_modes() for AQCS109 (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge and rename aqr105_read_status() and aqr107_read_status() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: use cached GLOBAL_CFG registers in aqr107_read_rate() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: remove handling for get_rate_matching(PHY_INTERFACE_MODE_NA) (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: save a local shadow of GLOBAL_CFG register values (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: fill supported_interfaces for all aqr_gen2_config_init() callers (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename some aqr107 functions according to generation (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: reorder AQR113C PMD Global Transmit Disable bit clearing with supported_interfaces (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: merge aqr113c_fill_interface_modes() into aqr107_fill_interface_modes() (Izabela Bakollari) [RHEL-121401]
  - net: phy: aquantia: rename AQR412 to AQR412C and add real AQR412 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add support for lan8842 (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Replace hardcoded pages with defines (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Introduce lanphy_modify_page_reg (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Start using PHY_ID_MATCH_MODEL (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix timestamping for vsc8584 (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed: remove usage of a faux device (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: report and configure in-band auto-negotiation for SGMII/QSGMII (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: convert RTL8226-CG to c45 only (Izabela Bakollari) [RHEL-121401]
  - net: phy: motorcomm: Add support for PHY LEDs on YT8521 (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: fix the PHY ID mismatch issue when using C45 (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: add proper reset flags for LAN8710A (Izabela Bakollari) [RHEL-121401]
  - phy: mscc: Fix parsing of unicast frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: fix KSZ8081/KSZ8091 cable test (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Enable WoL support using shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca807x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Support PHY counter (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: Add PHY counter support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Don't register LEDs for genphy (Izabela Bakollari) [RHEL-121401]
  - net: phy: micrel: Add ksz9131_resume() (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm54811: PHY initialization (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm5481x: MII-Lite activation (Izabela Bakollari) [RHEL-121401]
  - net: phy: MII-Lite PHY interface mode (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix link failure in forced mode with Auto-MDIX (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Force predictable MDI-X state on LAN87xx (Izabela Bakollari) [RHEL-121401]
  - net: phy: smsc: Fix Auto-MDIX configuration when disabled by strap (Izabela Bakollari) [RHEL-121401]
  - net: phy: declare package-related struct members only if CONFIG_PHY_PACKAGE is enabled (Izabela Bakollari) [RHEL-121401]
  - net: phylink: add phylink_sfp_select_interface_speed() (Izabela Bakollari) [RHEL-121401]
  - net: phylink: clear SFP interfaces when not in use (Izabela Bakollari) [RHEL-121401]
  - net: phylink: restrict SFP interfaces to those that are supported (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: qca808x: Fix WoL issue by utilizing at8031_set_wol() (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: move the WoL function to shared library (Izabela Bakollari) [RHEL-121401]
  - net: phy: air_en8811h: Introduce resume/suspend and clk_restore_context to ensure correct CKO settings after network interface reinitialization. (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: add error handling to rtl8211f_get_wol (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add interface types for 50G and 100G (Izabela Bakollari) [RHEL-121401]
  - net: phy: qcom: at803x: Add Qualcomm IPQ5018 Internal PHY support (Izabela Bakollari) [RHEL-121401]
  - net: sfp: add quirk for Potron SFP+ XGSPON ONU Stick (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add c45_phy_ids sysfs directory entry (Izabela Bakollari) [RHEL-121401]
  - net: phy: add flag is_genphy_driven to struct phy_device (Izabela Bakollari) [RHEL-121401]
  - net: phy: add Kconfig symbol PHY_PACKAGE (Izabela Bakollari) [RHEL-121401]
  - net: phy: make phy_package a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: make mdio consumer / device layer a separate module (Izabela Bakollari) [RHEL-121401]
  - net: phy: remove Kconfig symbol MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: factor out provider part from mdio_bus.c (Izabela Bakollari) [RHEL-121401]
  - mdio: fix CONFIG_MDIO_DEVRES selects (Izabela Bakollari) [RHEL-121401]
  - net: ethernet: Add missing depends on MDIO_DEVRES (Izabela Bakollari) [RHEL-121401]
  - net: phy: move __phy_package_[read|write]_mmd to phy_package.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve rgmii_clock() documentation (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: switch to adaptive polling and remove random delays (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: remove redundant 600ms post-reset delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: dp83tg720: implement soft reset with asymmetric delay (Izabela Bakollari) [RHEL-121401]
  - net: phy: directly copy struct mdio_board_info in mdiobus_register_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: improve mdio-boardinfo.h (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of struct mdio_board_entry to mdio-boardinfo.c (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify mdiobus_setup_mdiodev_from_board_info (Izabela Bakollari) [RHEL-121401]
  - net: phy: simplify phy_get_internal_delay() (Izabela Bakollari) [RHEL-121401]
  - net: phy: move definition of genphy_c45_driver to phy_device.c (Izabela Bakollari) [RHEL-121401]
  - net/mdiobus: Fix potential out-of-bounds read/write access (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Stop clearing the the UDPv4 checksum for L2 frames (Izabela Bakollari) [RHEL-121401]
  - net: phy: mscc: Fix memory leak when using one step timestamping (Izabela Bakollari) [RHEL-121401]
  - net: phy: fix up const issues in to_mdio_device() and to_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: clear phydev->devlink when the link is deleted (Izabela Bakollari) [RHEL-121401]
  - net: phy: mediatek: Add Airoha AN7583 PHY support (Izabela Bakollari) [RHEL-121401]
  - net: phy: Add support for Aeonsemi AS21xxx PHYs (Izabela Bakollari) [RHEL-121401]
  - net: phy: introduce genphy_match_phy_device() (Izabela Bakollari) [RHEL-121401]
  - net: phy: nxp-c45-tja11xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: bcm87xx: simplify .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: pass PHY driver to .match_phy_device OP (Izabela Bakollari) [RHEL-121401]
  - net: phy: fixed_phy: transition to the faux device interface (Izabela Bakollari) [RHEL-121401]
  - net: phy: realtek: HWMON support for standalone versions of RTL8221B and RTL8251 (Izabela Bakollari) [RHEL-121401]
  - xen/netfront: stop tx queues during live migration (Thilak KN) [RHEL-134437]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-685.el9]
changelog:
  - gpio: tegra186: Fix GPIO name collisions for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra410 (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Use generic macro for port definitions (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Add support for Tegra256 (Jennifer Berringer) [RHEL-135121]
  - dt-bindings: gpio: Add Tegra256 support (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: fix resource handling in ACPI probe path (Jennifer Berringer) [RHEL-135121]
  - gpio: tegra186: Replace of_node_to_fwnode() with more suitable API (Jennifer Berringer) [RHEL-135121]
  - tools headers arm64: Add NVIDIA Olympus part (Charles Mirabile) [RHEL-138475]
  - perf arm-spe: Add NVIDIA Olympus to neoverse list (Charles Mirabile) [RHEL-138475]
  - soc/tegra: fuse: Do not register SoC device on ACPI boot (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Fix crash in tegra_fuse_readl() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add ACPI support for Tegra194 and Tegra234 (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to print SKU info (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add function to add lookups (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Add tegra_acpi_init_apbmisc() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Refactor resource mapping (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use dev_err_probe for probe failures (Jennifer Berringer) [RHEL-135125]
  - mm/util: Introduce kmemdup_array() (Jennifer Berringer) [RHEL-135125]
  - soc/tegra: fuse: Use devm_platform_get_and_ioremap_resource() (Jennifer Berringer) [RHEL-135125]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-686.el9]
changelog:
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]
  - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]
  - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]
  - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.el9]
changelog:
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]
  - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]
  - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.1.1.el9_8]
changelog:
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}
  - redhat: update self-test data (Patrick Talbert)
  - redhat: set defaults for 9.8 (Patrick Talbert)
  - gitlab-ci: disttag override for 9.8 (Patrick Talbert)
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.2.1.el9_8]
changelog:
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]
  - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]
  - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]
  - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.3.1.el9_8]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
  - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
  - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.4.1.el9_8]
changelog:
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: Kamal Heib <kheib@redhat.com> - 60.0-1
changelog:
  - Rebase to upstream release v60.0
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-2
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-100679, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 60.0-3
changelog:
  - bump release to rebuild in sidetag
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Kamal Heib <kheib@redhat.com> - 61.0-1
changelog:
  - Rebase to upstream release v61.0
  - Resolves: RHEL-98270, RHEL-97696, RHEL-97692, RHEL-97648, RHEL-95331


author: Vladislav Dronov <vdronov@redhat.com> - 25.08.0-1
changelog:
  - Update to qatlib 25.08.0 @ 686d209b (RHEL-91078)
  - Add autoconf-archive as a dependency
  - Add update_sample to qatlib-tests
  - Add manpage for cpa_sample_code
  - Add sysusers.d config file to allow rpm to create users/groups automatically


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-8
changelog:
  - kvm-file-posix-Handle-suspended-dm-multipath-better-for-.patch [RHEL-133303]
  - Resolves: RHEL-133303
    (The VM hit io error when do S3-PR integration on the pass-through  failover multipath device [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-9
changelog:
  - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144]
  - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193]
  - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193]
  - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193]
  - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193]
  - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193]
  - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193]
  - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193]
  - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193]
  - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193]
  - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193]
  - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193]
  - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193]
  - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193]
  - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193]
  - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193]
  - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193]
  - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193]
  - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193]
  - Resolves: RHEL-131144
    (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8])
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-10
changelog:
  - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193]
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-11
changelog:
  - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240]
  - Resolves: RHEL-138240
    (QEMU crashes when stopping source VM during live migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-12
changelog:
  - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989]
  - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989]
  - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989]
  - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989]
  - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187]
  - kvm-q35-increase-default-tseg-size.patch [RHEL-139057]
  - Resolves: RHEL-132989
    (Expose block limits of block nodes in QMP and qemu-img [rhel-9])
  - Resolves: RHEL-140187
    (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8])
  - Resolves: RHEL-139057
    ([qemu, rhel-9] increase default TSEG size)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-13
changelog:
  - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422]
  - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620]
  - Resolves: RHEL-147422
    (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts)
  - Resolves: RHEL-130620
    (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-14
changelog:
  - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115]
  - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115]
  - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115]
  - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115]
  - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115]
  - Resolves: RHEL-67115
    ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-15
changelog:
  - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396]
  - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396]
  - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396]
  - Resolves: RHEL-149396
    (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-16
changelog:
  - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679]
  - Resolves: RHEL-151679
    ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17
changelog:
  - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948]
  - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174]
  - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174]
  - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174]
  - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174]
  - Resolves: RHEL-155947
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8])
  - Resolves: RHEL-155948
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9])
  - Resolves: RHEL-154174
    (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8])


author: Peter Koprda <pkoprda@redhat.com> - 0.2.7-4
changelog:
  - Update yggdrasil to 0.2.7.2
  - Update yggdrasil-worker-package-manager to 0.1.3.2
  - Resolves: RHEL-160833
  - Resolves: CVE-2026-33186


author: Jeremy Crafts <jcrafts@redhat.com> - 0.1.13-5
changelog:
  - Update rhc-worker-playbook to 0.1.13 (RHEL-137408)
  - Reduce size of rhc-worker-playbook messages (RHEL-142699)
  - Invoke rhc-playbook-verifier for playbook verification (RHEL-142700)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-40
changelog:
  - Improve error handling on keystore load (RHEL-114837)
  - Sort files before passing to file attr dependency generators (RHEL-95376)


author: Attila Lakatos <alakatos@redhat.com> - 8.2510.0-2
changelog:
  - Rebase to 8.2510.0
  - gnutls netstream driver: improve doc
    Resolves: RHEL-86031
  - rsyslog.conf: use RainerSscript syntax in actions
    Resolves: RHEL-42508
  - gnutls netstream driver: report missing certificate just once
    Resolves: RHEL-105782


author: Jarek Prokop <jprokop@redhat.com> - 3.3.10-6
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171255


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-164
changelog:
  - Undefine GC compaction methods on ppc64le.
    Resolves: RHEL-83136
  - Fix printing warnings when using IRB from a script.
    Resolves: RHEL-83044


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-165
changelog:
  - Fix Denial of Service in CGI::Cookie.parse. (CVE-2025-27219)
    Resolves: RHEL-86104
  - Fix ReDoS in CGI::Util#escapeElement. (CVE-2025-27220)
    Resolves: RHEL-86130


author: Jarek Prokop <jprokop@redhat.com> - 3.0.7-166
changelog:
  - Fix arbitrary code execution via deserialization bypass in ERB. (CVE-2026-41316)
    Resolves: RHEL-171254


author: Jun Aruga <jaruga@redhat.com> - 3.3.10-5
changelog:
  - Upgrade to Ruby 3.3.10.
    Resolves: RHEL-106821
  - Fix possible denial of service in resolv gem (CVE-2025-24294)
  - Fix URI Credential Leakage Bypass previous fixes. (CVE-2025-61594)
  - Fix REXML denial of service. (CVE-2025-58767)
    Resolves: RHEL-126728


author: Dan Horák <dhorak@redhat.com> - 2:2.39.0-1
changelog:
  - rebased to 2.39.0 (RHEL-100439)
  - udev/rules.d: Set default io scheduler to 'none' for virtio-blk (RHEL-126743)
  - udev/rules.d: make virtio-blk devices non-rotational (RHEL-126745)
  - zipl: makedumpfile is required for ngdump support (RHEL-114663)
  - libekmfweb: Fix gen of cert or CSR to use RSA not RSA-PSS (RHEL-114885)
  - chpstat: Fix DPU utilization scaling in reports (RHEL-109215)
  - Resolves: RHEL-100439 RHEL-126743 RHEL-126745 RHEL-114663 RHEL-114885 RHEL-109215


author: Dan Horák <dhorak@redhat.com> - 2:2.40.0-1
changelog:
  - rebased to 2.40.0 (RHEL-100439)
  - zipl/boot: Fix unused loadparm when SCLP line-mode console is absent
  - Secure Execution: Add tool to verify host-key documents (RHEL-136796)
  - Resolves: RHEL-100439 RHEL-136796


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-22.3
changelog:
  - Resolves: RHEL-160693 - squid: Squid: Denial of Service via
    heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-22.4
changelog:
  - Resolves: RHEL-160692 - squid: Squid: Denial of Service via
    crafted ICP traffic (CVE-2026-32748)


author: Wander Lairson Costa <wander@redhat.com> - 1.26.3-1
changelog:
  - Rebase to stalld-1.26.3
  - Build System Improvements and added riscv64 arch
  - Remove LTO build flags
  - Make queue_track the default backend
  - Remove the -m64 build option
  Resolves: RHEL-111528 RHEL-111526 RHEL-96207 RHEL-96205 RHEL-111803


author: Alejandro López <allopez@redhat.com> - 1.9.5p2-15
changelog:
  RHEL 9.7.0 ERRATUM
  - CVE-2026-35535 - Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166065


author: systemd maintenance team <systemd-maint@redhat.com> - 252-55.8
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150628)


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-6.1
changelog:
  - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002,
    CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities
    Resolves: RHEL-163212
    Resolves: RHEL-163280
    Resolves: RHEL-163266
  - Fix CVE-2026-34352
    Resolves: RHEL-167769


author: Petr Menšík <pemensik@redhat.com> - 1.24.2-2
changelog:
  - Switch TLS configuration to follow TLS sockets by crypto-policy again
    (RHEL-147860)
  - Change the default of tls-use-system-policy-versions at build-time


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-1
changelog:
  - Valgrind 3.26.0 final
  - Remove all VALGRIND_3_25_BRANCH and proposed upstream patches
  - Refresh some-stack-protector and some-Wl-z-now patches.
  - Add vgstack to valgrind-gdb.
  - Update License to GPL-3.0-or-later


author: Mark Wielaard <mjw@redhat.com> - 3.26.0-4
changelog:
  - Add VALGRIND_3_26_BRANCH patches
    - 0001-Prepare-NEWS-for-branch-3.26-fixes.patch
    - 0002-Bug-511972-valgrind-3.26.0-tests-fail-to-build-on-up.patch
    - 0003-readlink-proc-self-exe-overwrites-buffer-beyond-its-.patch
    - 0004-Linux-DRD-suppression-add-an-entry-for-__is_decorate.patch
    - 0005-Linux-Helgrind-add-a-suppression-for-_dl_allocate_tl.patch
    - 0006-Disable-linux-madvise-MADV_GUARD_INSTALL.patch
    - 0007-Bug-514613-Unclosed-leak_summary-still_reachable-tag.patch
    - 0008-Bug-514206-Assertion-sr_isError-sr-failed-mmap-fd-po.patch


author: Petr Dancak <pdancak@redhat.com> - 2:8.2.2637-23.2
changelog:
  - RHEL-155437 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155422 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file
  - RHEL-159629 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26
changelog:
  - RHEL-155438 CVE-2026-28417 vim: Vim: Arbitrary code execution via OS command injection in the netrw plugin
  - RHEL-155423 CVE-2026-28421 vim: Vim: Denial of service and information disclosure via crafted swap file


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.1
changelog:
  - RHEL-159630 CVE-2026-33412 vim: Vim: Arbitrary code execution via command injection in glob() function


author: Miroslav Rezanina <mrezanin@redhat.com> - 1.13.3-1
changelog:
  - Rebase to 1.13.3 [RHEL-133032]
  - Resolves: RHEL-133032
    (Rebase virtiofsd to latest version for RHEL 9.8)


author: Kashyap <kekbote@redhat.com> - 2.50.3-1
changelog:
  - Update to 2.50.3
  - Fix CVE-2025-43443 with Rebase
  - Fix CVE-2025-43440 with Rebase
  - Fix CVE-2025-43434 with Rebase
  - Fix CVE-2025-43432 with Rebase
  - Fix CVE-2025-43431 with Rebase
  - Fix CVE-2025-43430 with Rebase
  - Fix CVE-2025-43429 with Rebase
  - Fix CVE-2025-43427 with Rebase
  - Fix CVE-2025-43425 with Rebase
  - Fix CVE-2025-43421 with Rebase
  - Fix CVE-2025-43392 with Rebase
  - Fix CVE-2025-66287 with Rebase
  - Fix CVE-2025-43458 with Rebase
  - Fix CVE-2025-13947 with Rebase
  - Fix CVE-2025-13502 with Rebase


author: Ravina Jain <rajain@redhat.com> - 2.50.4-1
changelog:
  - Update to 2.50.4
  - Fix CVE-2025-43529 with Rebase
  - Fix CVE-2025-43531 with Rebase
  - Fix CVE-2025-43501 with Rebase
  - Fix CVE-2025-43536 with Rebase
  - Fix CVE-2025-43535 with Rebase
  - Fix CVE-2025-43541 with Rebase


author: Toke Høiland-Jørgensen <toke@redhat.com> 1.5.7-1
changelog:
  - Upstream version bump
  - Add annocheck exceptions for BPF objects (Felix)
  - Re-enable debug builds (Felix)
  - Add libcap-ng-devel to BuildDepends


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-32
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119963), CVE-2025-62230 (RHEL-120035),
                 CVE-2025-62231 (RHEL-125003)


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-33
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163225
    Resolves: https://redhat.atlassian.net/browse/RHEL-163307
    Resolves: https://redhat.atlassian.net/browse/RHEL-163238


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-6
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163198
    Resolves: https://redhat.atlassian.net/browse/RHEL-163294
    Resolves: https://redhat.atlassian.net/browse/RHEL-163252


author: Vladimír Beneš <vbenes@redhat.com>- 1:1.54.1-1
changelog:
  - Update to 1.54.1
  - Adding a VF configuration resets and re-configures all other VFs (RHEL-113954)
  - Fix connection.autoconnect-ports of OVS ports (RHEL-114200)
  - Global DNS config without domains silently ignored from D-Bus (RHEL-115973)


author: Íñigo Huguet <ihuguet@redhat.com> - 1:1.54.2-1
changelog:
  - Update to 1.54.2
  - Support setting protocol version of HSR/PRP (RHEL-122172)
  - Support interlink for HSR/PRP (RHEL-122175)
  - Improve logging of networking off (RHEL-122173 )
  - Don't delete unrelated OVS ports (RHEL-121104)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-1
changelog:
  - Update to later upstream release to address regressions (RHEL-56551)
  - Support rightca in ipsec section (RHEL-118819)


author: Vladimír Beneš <vbenes@redhat.com> - 1.2.27-2
changelog:
  - Symetric import/export with nm-auto-default (RHEL-122306)
  - Esp param properly exported (RHEL-122626)
  - Correct leftid export when it contains @


author: Gris Ge <fge@redhat.com> - 1.2.29-1
changelog:
  - Upgrade to 1.2.29
  - Support creating both ends of IPsec (Libreswan) tunnels. (RHEL-85789)
  - Support leftprotoport and rightprotoport options. (RHEL-130907)
  - Fix error on duplicate key 'phase2alg'. (RHEL-131233)
  - Fix import connection with RSA key. (RHEL-127863)


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-1
changelog:
  RHEL 9.8.0 ERRATUM
  - rebase to 0.19.2
  Resolves: RHEL-110573
  - Switch to libnettle for hashing
  - prevent aide from crashing if database is a HTTPS URL
  Resolves: RHEL-76014
  - prevent aide from exiting if a file is truncated during check
  Resolves: RHEL-1569


author: Attila Lakatos <alakatos@redhat.com> - 0.19.2-4
changelog:
  - /boot/grub2/grubenv is excluded from check due to boot_success implementation
  Resolves: RHEL-83776


author: Colin Walters <walters@verbum.org> - 1.12.1-1
changelog:
  - Update to 1.12.1
  - Fix mount point check regression breaking bootc-image-builder
  - Resolves: RHEL-142112


author: Colin Walters <walters@verbum.org> - 1.13.0-1
changelog:
  - Update to 1.13.0
  - https://github.com/bootc-dev/bootc/releases/tag/v1.13.0
  - Resolves: RHEL-151443


author: Jon Maloy <jmaloy@redhat.com> - 4.0.2-11
changelog:
  - Fix CVE-2025-68114 (memory corruption) and CVE-2025-67873 (heap buffer overflow)
    Resolves: RHEL-137760


author: Jindrich Novy <jnovy@redhat.com> - 1:1.8.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.8.0
  - Related: RHEL-111919


author: Jindrich Novy <jnovy@redhat.com> - 1:1.9.0-1
changelog:
  - update to https://github.com/containernetworking/plugins/releases/tag/v1.9.0
  - Related: RHEL-111919


author: Gregory Bell <grbell@redhat.com> - 1.31-1
changelog:
  - Rework the selection of functions to represent in BTF, for instance:
  - Skip functions that passes values thru the stack when those structs don't
  have expected alignment due to some attribute usage that then causes
  problems with BTF trampolines due to lack of expressiveness in BTF to
  signal such special cases.
  - Skip objects (compile units) without DWARF: don't stop a multi object
  encoding session just because one doesn't have any DWARF in it.
  - Fix BTF dedup by updating libbpf. 
  - Fix the inference of the explicit alignment attribute of zero length arrays,
  like struct skb_ext->data[] in the Linux kernel. Important as BTF has no no
  explicit alignment attribute encoding.
  - Fix the inference of alignments after bitfields, such as in struct
  nft_rule_dp->data[] after ->handle:42, also in the Linux kernel.    
  - Fix segfault with --show_reorg_steps option, e.g. pahole -R -S -C task_struct.
  - Add comparision of functions encoded in BTF between baseline 'master' branch
  and current branch, i.e. 'next'.


author: Olivier Fourdan <ofourdan@redhat.com> - 40.0-8
changelog:
  - Add Xwayland and dbus-daemon as weak dependencies
    Resolves: https://issues.redhat.com/browse/RHEL-66572


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 2.8.14-2
changelog:
  - Add tmpfiles.d file to make systemd-tmpfiles create/set correct
    ownership/permissions of /var/lib/haproxy
    Resolves: RHEL-120178


author: RHEL Packaging Agent <jotnar@redhat.com> - 1.8.12-1
changelog:
  - Rebase to version 1.8.12
  - Update license to MIT AND X11 (SPDX migration)
  - Change source format from .tar.bz2 to .tar.xz
  - Add libtool as BuildRequires
  - Remove CVE patches (now included upstream)
  - Add patch to lower autoconf requirement to 2.69
  - Update dont-forward-keycode-0.patch for new codebase
  - Remove NEWS from %doc (file not present in 1.8.12)
  - Resolves: RHEL-111537


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131594)
  - CVE-2025-65018: heap buffer overflow (RHEL-131603)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
changelog:
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)


author: Michal Hlavinka <mhlavink@redhat.com> - 4.4.0-16
changelog:
  - fix CVE-2025-9900: Out-of-Bounds Write in TIFFReadRGBAImageOriented (RHEL-112543)
  - fix CVE-2025-8176: use after free in tiffmedian (RHEL-120238)


author: Jeff Moyer <jmoyer@redhat.com> - 2.12-1.el9
changelog:
  - Rebase to version 2.12.  Follow fedora and get rid of explicit %
    attr for library files
  - Resolves: RHEL-114115


author: Olivier Fourdan <ofourdan@redhat.com> - 40.9-31
changelog:
  - Backport linux-dmabuf v4 support to restore hardware acceleration
    in Xwayland 24.1 with Mesa 25.2
    Resolves: RHEL-129832


author: Miroslav Rezanina <mrezanin@redhat.com> - 13.0.0-2
changelog:
  - ovt-Address-CVE-2025-41244.patch [RHEL-117392]
  - Resolves: RHEL-117392
    ([CISA Major Incident] CVE-2025-41244 open-vm-tools: Local privilege escalation in open-vm-tools [rhel-9.8])


author: Lili Du <ldu@redhat.com> - 13.0.5-1
changelog:
  - Rebase to 13.0.5 [RHEL-118505]
  - Resolves: RHEL-118505
    ([ESXi][RHEL9] open-vm-tools version 13.0.5 has been released - please rebase)


author: Lili Du <ldu@redhat.com> - 13.0.5-1
changelog:
  - Rebase to 13.0.10 [RHEL-144578]
  - Resolves: RHEL-144578
    ([ESXi][RHEL9] open-vm-tools version 13.0.10 has been released - please rebase)


author: RHEL Packaging Agent <jotnar@redhat.com> - 7.2.0-1
changelog:
  - Rebase to papi 7.2.0
  - Update license tag to BSD-3-Clause
  - Remove old patches and add new patches for 7.2.0 compatibility
  - Update configure options and package files
  - Resolves: RHEL-121673


author: Petr Lautrbach <lautrbach@redhat.com> - 3.6-5
changelog:
  - sandbox/seunshare: Replace system() with execv() to prevent shell injection
  - seunshare: fix the frail tmpdir cleanup


author: Karel Zak <kzak@redhat.com> 2.37.4-22
changelog:
  - fix RHEL-113638 - lscpu: update ARM identifiers
  - fix RHEL-108386 - libblkid: (jmicron_raid) backport checksum verification


author: Karel Zak <kzak@redhat.com> 2.37.4-23
changelog:
  - fix RHEL-123527 - mount: improve --all documentation
  - fix RHEL-123531 - libblkid: use snprintf() instead of sprintf()
  - fix RHEL-123536 - libfdisk: (dos) fix off-by-one in maximum last sector calculation


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-6
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143110
  Resolves: RHEL-143170
  Resolves: RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.11.13-7
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143110, RHEL-143170, RHEL-144894


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-5
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143112
  Resolves: RHEL-143172
  Resolves: RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.12-6
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143112, RHEL-143172, RHEL-144895


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.14.0-2
changelog:
  - Initial package
  - Fedora contributions by:
        Björn Esser <besser82@fedoraproject.org>
        Bohuslav Kabrda <bkabrda@redhat.com>
        Charalampos Stratakis <cstratak@redhat.com>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        Dennis Gilmore <dennis@ausil.us>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <limb@fedoraproject.org>
        Igor Gnatenko <ignatenkobrain@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jaroslav Škarvada <jskarvad@redhat.com>
        Jason ティビツ <tibbs@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Karsten Hopp <karsten@redhat.com>
        Lukáš Zachar <lzachar@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Marcel Plch <mplch@redhat.com>
        Matej Stuchlik <mstuchli@redhat.com>
        Michal Cyprian <mcyprian@redhat.com>
        Michal Toman <mtoman@fedoraproject.org>
        Miro Hrončok <mhroncok@redhat.com>
        Nicolas Chauvet <kwizart@gmail.com>
        Orion Poplawski <orion@cora.nwra.com>
        Patrik Kopkan <pkopkan@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Petr Šplíchal <psplicha@redhat.com>
        Petr Viktorin <pviktori@redhat.com>
        Rex Dieter <rdieter@fedoraproject.org>
        Richard W.M. Jones <rjones@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Sahana Prasad <sahana@redhat.com>
        Stephen Gallagher <sgallagh@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Till Maas <opensource@till.name>
        Tom Stellard <tstellar@redhat.com>
        Tomas Mraz <tmraz@fedoraproject.org>
        Tomas Orsava <torsava@redhat.com>
        Tomas Radej <tradej@redhat.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        U2FsdGVkX1 <U2FsdGVkX1@gmail.com>
        Victor Stinner <vstinner@redhat.com>
        Ville Skyttä <ville.skytta@iki.fi>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672,CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-11468, CVE-2025-15366,
  CVE-2025-15367
  Resolves: RHEL-144896, RHEL-143115, RHEL-143173


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 5.0.2-5
changelog:
  - Initial package
  Fedora contributions by:
      Adam Williamson <awilliam@redhat.com>
      Alexander Bokovoy <abokovoy@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Dan Callaghan <dcallagh@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenko@redhat.com>
      Iryna Shcherbina <ishcherb@redhat.com>
      Jakub Dorňák <jdornak@redhat.com>
      James Bowes <jbowes@redhat.com> 1.0-1
      Jan Kaluza <jkaluza@redhat.com>
      Jesse Keating <jkeating@fedoraproject.org>
      Joe Orton <jorton@redhat.com>
      Josh Kayse <joshkayse@fedoraproject.org>
      Karolina Surma <ksurma@redhat.com>
      Kevin Fenzi <kevin@fedoraproject.org>
      Luboš Uhliarik <luhliari@redhat.com>
      Luke Macken <lmacken@redhat.com>
      Matthias Runge <mrunge@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Orion Poplawski <orion@cora.nwra.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Richard W.M. Jones <rjones@redhat.com>
      Ricky Zhou <ricky@fedoraproject.org>
      Tomas Orsava <torsava@redhat.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Stellard <tstellar@redhat.com>
      Troy Dawson <tdawson@redhat.com>
      Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.3.4-1
changelog:
  - Initial import
  - Fedora contributions by:
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        Dan Horák <dan@danny.cz>
        David Malcolm <dmalcolm@redhat.com>
        David Tardon <dtardon@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Iñaki Úcar <iucar@fedoraproject.org>
        Iryna Shcherbina <shcherbina.iryna@gmail.com>
        Jarod Wilson <jwilson@fedoraproject.org>
        Jaromir Capik <jcapik@redhat.com>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Lukáš Zaoral <lzaoral@redhat.com>
        Lumir Balhar <lbalhar@redhat.com>
        Merlin Mathesius <mmathesi@redhat.com>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@gmail.com>
        Robert Kuska <rkuska@redhat.com>
        Scott Talbert <swt@techie.net>
        Simone Caronni <negativo17@gmail.com>
        Songsong Zhang <u2fsdgvkx1@gmail.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomáš Hrnčiar <thrnciar@redhat.com>
        Tomas Orsava <torsava@redhat.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Tulio Magno Quites Machado Filho <tuliom@redhat.com>
        Ville Skyttä <scop@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.9.10-3
changelog:
  - Initial package
  Fedora contributions by:
      Ales Nezbeda <anezbeda@redhat.com>
      Bill Nottingham <notting@fedoraproject.org>
      Bohuslav Kabrda <bkabrda@redhat.com>
      Charalampos Stratakis <cstratak@redhat.com>
      David Malcolm <dmalcolm@redhat.com>
      Dennis Gilmore <dennis@ausil.us>
      Devrim Gündüz <devrim@gunduz.org>
      Filip Januš <fjanus@redhat.com>
      Honza Horak <hhorak@redhat.com>
      Ignacio Vazquez-Abrams <ivazqueznet+rpm@gmail.com>
      Igor Gnatenko <ignatenkobrain@fedoraproject.org>
      Jason L Tibbitts III <tibbs@math.uh.edu>
      Jesse Keating <jkeating@fedoraproject.org>
      Jozef Mlich <jmlich@redhat.com>
      Lumír Balhar <lbalhar@redhat.com>
      Miro Hrončok <mhroncok@redhat.com>
      Ondřej Sloup <ondrej.sloup@protonmail.com>
      Patrik Novotný <panovotn@redhat.com>
      Pavel Raiskup <praiskup@redhat.com>
      Petr Kubat <pkubat@redhat.com>
      Peter Robinson <pbrobinson@fedoraproject.org>
      Todd Zullinger <tmz@pobox.com>
      Tomas Hrnciar <thrnciar@redhat.com>
      Tom Lane <tgl@redhat.com>


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 1.16.2-1
changelog:
  - Initial package
  - Fedora contributions by:
        Antonio Trande <anto.trande@gmail.com>
        Benjamin A. Beasley <code@musicinmybrain.net>
        Bill Nottingham <notting@fedoraproject.org>
        Björn Esser <me@besser82.io>
        Charalampos Stratakis <cstratak@redhat.com>
        Christian Dersch <lupinix@mailbox.org>
        David Abdurachmanov <davidlt@rivosinc.com>
        David Malcolm <dmalcolm@redhat.com>
        Deji Akingunola <deji@fedoraproject.org>
        Dennis Gilmore <dennis@ausil.us>
        dmalcolm <dmalcolm@fedoraproject.org>
        Elliott Sales de Andrade <quantum.analyst@gmail.com>
        Florian Weimer <fweimer@redhat.com>
        Gwyn Ciesla <gwync@protonmail.com>
        Ignacio Vazquez-Abrams <ivazquez@fedoraproject.org>
        Igor Gnatenko <ignatenko@redhat.com>
        Iñaki Úcar <iucar@fedoraproject.org>
        Jef Spaleta <jspaleta@fedoraproject.org>
        Jerry James <loganjerry@gmail.com>
        Jesse Keating <jkeating@fedoraproject.org>
        Jitka Plesnikova <jplesnik@redhat.com>
        Jonathan Wakely <jwakely@redhat.com>
        Kalev Lember <klember@redhat.com>
        Karolina Surma <ksurma@redhat.com>
        Kevin Fenzi <kevin@scrye.com>
        Lumir Balhar <lbalhar@redhat.com>
        Mamoru TASAKA <mtasaka@fedoraproject.org>
        Marcel Plch <mplch@redhat.com>
        Maxwell G <maxwell@gtmx.me>
        Miro Hrončok <miro@hroncok.cz>
        Nikola Forró <nforro@redhat.com>
        Nils Philippsen <nils@redhat.com>
        Orion Poplawski <orion@nwra.com>
        Pavel Šimovec <psimovec@redhat.com>
        Peter Robinson <pbrobinson@fedoraproject.org>
        Petr Viktorin <pviktori@redhat.com>
        Robert Kuska <rkuska@redhat.com>
        Than Ngo <than@redhat.com>
        Thomas Spura <thomas.spura@gmail.com>
        Tomas Tomecek <ttomecek@redhat.com>
        Toshio Kuratomi <toshio@fedoraproject.org>
        Troy Dawson <tdawson@fedoraproject.org>
        Yaakov Selkowitz <yselkowi@redhat.com>
        Zbigniew Jędrzejewski-Szmek <zbyszek@in.waw.pl>


author: Vladislav Dronov <vdronov@redhat.com> - 1.0.0-1
changelog:
  - Update to qat-zstd-plugin 1.0.0 @ 1e8b930c (RHEL-72905)
  - NUMA node aware mem allocations and other Code optimizations
  - Bug Fixes and Static analysis Fixes (OpenScanhub and Latest Coverity)
  - Support ZSTD v1.5.7 and README refactor
  - Spec file updates for RPM Packaging


author: Matyas Horky <mhorky@redhat.com> - 0.2.7-3
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2025-61729
  - Resolves: RHEL-140560
  - Resolves: CVE-2025-61726
  - Resolves: RHEL-146045
  - Resolves: CVE-2025-68121
  - Resolves: RHEL-149647


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.4-1
changelog:
  - Update to version 4.23.4
  - resolves: RHEL-114548 - Update to version 4.23.4
  - resolves: RHEL-132995 - Fix Time Machine backup
  - resolves: RHEL-133003 - Remove unexpected dependency of libldb to samba


author: Pavel Filipenský <pfilipensky@samba.org> - 0:4.23.5-1
changelog:
  - Update to version 4.23.5
  - resolves: RHEL-143401 - Fix winbind group resolution
  - resolves: RHEL-141027 - Fix winbind crash


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 1.4.9-26
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-118293
  - Eliminate use of obsolete %patchN syntax
    Related: RHEL-91101
  - Add sysusers.d config file to allow rpm to create users/groups automatically
    and drop attempt to delete group
    Related: RHEL-91101
  - Add support for Image Mode
    Resolves: RHEL-91101


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-23
changelog:
  - Resolves: RHEL-122493 - squid: Squid vulnerable to information disclosure via
    authentication credential leakage in error handling (CVE-2025-62168)


author: Luboš Uhliarik <luhliari@redhat.com> - 7:5.5-24
changelog:
  - Resolves: RHEL-119047 - "ICAP_ERR_OTHER/408" occurs in icap.log when
    downloading a file on RHEL9


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-25
changelog:
  - Resolves: RHEL-160695 - squid: Squid: Denial of Service via
    heap Use-After-Free vulnerability in ICP handling (CVE-2026-33526)


author: Tomas Korbar <tkorbar@redhat.com> - 7:5.5-26
changelog:
  - Resolves: RHEL-160694 - squid: Squid: Denial of Service via
    crafted ICP traffic (CVE-2026-32748)


author: Tomas Halman <thalman@redhat.com> - 2.9.8-1
changelog:
  - Resolves: RHEL-143692 - SSSD Rebase for RHEL 9.8
  - Resolves: RHEL-133967 - Remove SSSD option ipa_enable_dns_sites
  - Resolves: RHEL-133469 - 'sssd_nss' hangs when looking up an object by ID that has expired cache entry and filtered out by name 
  - Resolves: RHEL-133006 - SSSD: change a default value of 'session_provider' sssd.conf option to 'none'
  - Resolves: RHEL-132984 - sssd_be: segfault at 8 ip 00007f6fd25b2b90 sp 00007ffc02dfbae0 error 4 in libsss_ipa.so
  - Resolves: RHEL-132506 - RFE: package LDAP provider support for subid ranges
  - Resolves: RHEL-120297 - CVE-2025-11561 sssd: SSSD default Kerberos configuration allows privilege escalation on AD-joined Linux
  - Resolves: RHEL-87530 - AD user in external group is not cleared when expiring the cache


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-2
changelog:
  - Request to backport support for regex in sudo [rhel-9]
  Resolves: RHEL-1376
  - Rebase of sudo to 1.9.17p2 [rhel-9]
  Resolves: RHEL-128623
  - sudo passes SHELL environment variable twice to the shell being executed [rhel-9]
  Resolves: RHEL-127359


author: systemd maintenance team <systemd-maint@redhat.com> - 252-57
changelog:
  - Revert "boot: Use EFI_BOOT_MANAGER_POLICY_PROTOCOL to connect console devices" (RHEL-108596)
  - boot: Use correct memory type for allocations (RHEL-108555)
  - meson: /etc/systemd/network is also used by udevd (RHEL-109096)
  - sd-bus: make bus_add_match_full accept timeout (RHEL-31756)
  - core/unit: add get_timeout_start_usec in UnitVTable and define it for service (RHEL-31756)
  - core/unit: increase the NameOwnerChanged/GetNameOwner timeout to the unit's start timeout (RHEL-31756)
  - core,sd-bus: drop empty lines between function call and error check (RHEL-31756)
  - core: do not disconnect from bus when failed to install signal match (RHEL-31756)
  - dbus: stash the subscriber list when we disconenct from the bus (RHEL-31756)
  - manager: s/deserialized_subscribed/subscribed_as_strv (RHEL-31756)
  - bus-util: do not reset the count returned by sd_bus_track_count_name() (RHEL-31756)
  - core/manager: restore bus track deserialization cleanup in manager_reload() (RHEL-31756)
  - core/manager: drop duplicate bus track deserialization (RHEL-31756)
  - sd-bus/bus-track: use install_callback in sd_bus_track_add_name() (RHEL-31756)
  - shell completion: add kernel-identify/inspect verbs for bootctl (RHEL-108576)
  - test: add tests for format_timestamp() and parse_timestamp() with various timezone (RHEL-109488)
  - test-time-util: disable failing tests (RHEL-109488)
  - test: test parse_timestamp() in various timezone (RHEL-109488)
  - systemctl: logind: add missing asserts (RHEL-109488)
  - systemctl: logind: make logind_schedule_shutdown accept action as param (RHEL-109488)
  - systemctl: add option --when for scheduled shutdown (RHEL-109488)
  - test-time-util: add test cases to invalidate "show" and "cancel" (RHEL-109488)
  - Introduce RET_GATHER and use it in src/shared/ (RHEL-108598)
  - fd-util: don't eat up errors in fd_cloexec_many (RHEL-108598)
  - sd-bus: refuse to send messages with an invalid string (RHEL-108584)
  - test: check if we correctly handle invalid UTF-8 in mount stuff (RHEL-108584)
  - test: fix a typo in the cleanup stuff (RHEL-108584)
  - test: explicitly specify a UTF-8 locale for UTF-8 shenanigans (RHEL-108584)
  - test: use the correct file name when restoring the original fstab (RHEL-108584)
  - core: escape UTF-8 in mount unit Where field before sending to clients (RHEL-108584)
  - Revert "test-time-util: disable failing tests" (RHEL-109488)
  - test: use get_timezones() to iterate all known timezones (RHEL-109488)
  - test-time-util: do not fail on DST change (RHEL-109488)
  - test-time-util: suppress timestamp conversion failures for Africa/Khartoum timezone (RHEL-109488)
  - test-time-util: do more suppression of time zone checks (RHEL-109488)
  - test-time-util: fix truncation of usec to sec (RHEL-109488)
  - test: unset TZ before timezone-sensitive unit tests are run (RHEL-109488)
  - meson: extend timeout for test-time-util (RHEL-109488)
  - time-util: use DEFINE_STRING_TABLE_LOOKUP_TO_STRING() macro (RHEL-109488)
  - time-util: align string table (RHEL-109488)
  - time-util: rename variables (RHEL-109488)
  - time-util: add assertions (RHEL-109488)
  - time-util: drop redundant else (RHEL-109488)
  - time-util: do not use strdupa() (RHEL-109488)
  - time-util: use result from startswith_no_case() (RHEL-109488)
  - time-util: use usec_add() and usec_sub_unsigned() (RHEL-109488)
  - time-util: shorten code a bit (RHEL-109488)
  - time-util: rename variables (RHEL-109488)
  - time-util: drop unnecessary assignment of timezone name (RHEL-109488)
  - time-util: make parse_timestamp() use the RFC-822/ISO 8601 standard timezone spec (RHEL-109488)
  - time-util: fix typo (RHEL-109488)
  - ci: bump the tools tree to F42 (RHEL-109488)
  - journald: extend STDOUT_STREAMS_MAX to 64k (RHEL-111065)
  - Revert "Revert "udev-builtin-net_id: use firmware_node/sun for ID_NET_NAME_SLOT"" (RHEL-50103)
  - udev-builtin-net_id: ignore firmware_node/sun == 0 (RHEL-50103)
  - fundamental: fix compile check for explicit_bzero (RHEL-108568)
  - time-util: make USEC_TIMESTAMP_FORMATTABLE_MAX for 32bit system off by one day (RHEL-109488)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-59
changelog:
  - test: rename TEST-53-ISSUE-16347 to TEST-53-TIMER (RHEL-118215)
  - test: restarting elapsed timer shouldn't trigger the corresponding service (RHEL-118215)
  - test: check the next elapse timer timestamp after deserialization (RHEL-118215)
  - timer: don't run service immediately after restart of a timer (RHEL-118215)
  - test: store and compare just the property value (RHEL-118215)
  - test: make test-fd-util more lenient when using fd_move_above_stdio() (RHEL-114974)
  - basic: add PIDFS magic (#31709) (RHEL-114974)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-60
changelog:
  - man: fix a missing word (RHEL-115182)
  - cryptsetup: Add optional support for linking volume key in keyring. (RHEL-97175)
  - cryptsetup: fix typo (RHEL-97175)
  - cryptsetup: HAVE_CRYPT_SET_KEYRING_TO_LINK is always defined (RHEL-97175)
  - coredump: make check that all argv[] meta data fields are passed strict (RHEL-104138)
  - coredump: restore compatibility with older patterns (RHEL-104138)
  - coredump: use %d in kernel core pattern (RHEL-104138)
  - pidref: add structure that can reference a pid via both pidfd and pid_t (RHEL-104138)
  - fd-util: introduce parse_fd() (RHEL-104138)
  - coredump: add support for new %F PIDFD specifier (RHEL-104138)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-61
changelog:
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215)
  - strv: introduce string_strv_hashmap_remove() (RHEL-14112)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-62
changelog:
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558)
  - timer: rebase last_trigger timestamp if needed (RHEL-118215)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-63
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859)
  - cryptsetup-generator: continue parsing after error (RHEL-127859)
  - cryptsetup-generator: parse all cmdline devices too (RHEL-127859)
  - cryptsetup-generator: always process cmdline devices (RHEL-127859)
  - logind: add "background-light" session class (RHEL-109833)
  - pam_systemd: honor session class provided via PAM environment (RHEL-109833)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-64
changelog:
  - core: fix array size in unit_log_resources() (RHEL-131338)
  - pid1: add env var to override default mount rate limit burst (RHEL-129153)
  - pid1: add env var to override default mount rate limit interval (RHEL-129153)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-65
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-66
changelog:
  - core/service: fix error cause in the log (RHEL-138414)
  - fstab-generator: drop assertions for mount opts (RHEL-92752)
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752)
  - core: reorder systemd arguments on reexec (RHEL-111135)
  - basic: add RuntimeScope enum (RHEL-137252)
  - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252)
  - sd-path: add support for XDG_STATE_HOME (RHEL-137252)
  - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252)
  - path tool: add some basic ansi highlighing (RHEL-137252)
  - execude: include RuntimeScope field in ExecParameters (RHEL-137252)
  - execute: remove redundant assignment (RHEL-137252)
  - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252)
  - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252)
  - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252)
  - execute: shorten some code by using RET_NERRNO() (RHEL-137252)
  - execute: shorten code by making use of laccess() return code properly (RHEL-137252)
  - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252)
  - test: add test for new XDG_STATE_HOME handling (RHEL-137252)
  - man: mention the newly-added XDG_STATE_HOME (RHEL-137252)
  - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252)
  - man: properly close XML tags (RHEL-137252)
  - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252)
  - test: use XDG_STATE_HOME for %S and %L (RHEL-137252)
  - man: fully adopt ~/.local/state/ (RHEL-137252)


author: Kate Hsuan <hpa@redhat.com> - 2.5.9-1
changelog:
  - Update to 2.5.9
  - Drop thermeld-monitor since the qcustomplot patch was out of date
    Resolves: RHEL-97639


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-66
changelog:
  - Use systemd-sysusers for the 'pegasus' user and group creation
  - Fix Requires of subpackages
    Related: RHEL-90737
  - Add support for Image Mode
    Resolves: RHEL-90737


author: RHEL Packaging Agent <jotnar@redhat.com> - 2.3.12-1
changelog:
  - Rebase to version 2.3.12
  - Add unixODBC-c89.patch for GCC 14 compatibility
  - Update so-version-bump.patch for new version
  - Fix multilib_fix_c_header path to match actual header location
  - Resolves: RHEL-94798


author: Olivier Fourdan <ofourdan@redhat.com> - 23.2.7-5
changelog:
  - CVE fix for: CVE-2025-62229 (RHEL-119977), CVE-2025-62230 (RHEL-120023),
                 CVE-2025-62231 (RHEL-125018)


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.0-3
changelog:
  - update to the latest content of https://github.com/containers/buildah/tree/release-1.43
    (https://github.com/containers/buildah/commit/bbc4bd1)
  - Resolves: RHEL-95964


author: Jindrich Novy <jnovy@redhat.com> - 2:1.43.1-1
changelog:
  - update to https://github.com/containers/buildah/releases/tag/v1.43.1
  - fixes CVE-2026-34986
  - Resolves: RHEL-165035


author: Jan Friesse <jfriesse@redhat.com> - 3.1.10-1.1
changelog:
  - Resolves: RHEL-163816
  - Resolves: RHEL-163837

  - totemsrp: Return error if sanity check fails (fixes CVE-2026-35091)
  - totemsrp: Fix integer overflow in memb_join_sanity (fixes CVE-2026-35092)


author: Pavel Valena <pvalena@redhat.com> - 057-110.git20260130
changelog:
  - fix(systemd-repart): allow partition format
  - feat(install.d):according to the changes of
  - feat(i18n): pull 'drm' or 'simpledrm' module unless excluded
  - fix(pcsc): add opensc load module file
  - fix(pcsc): add --disable-polkit to pcscd.service
  - fix(pkcs11): delete trailing dot on
  - fix(multipath): disable user_friendly_names with mpathconf
    Resolves: RHEL-103385,RHEL-103974,RHEL-109631,RHEL-145135,RHEL-91322


author: Frédéric Bérat <fberat@redhat.com> - 2.34-265
changelog:
  - Fix null pointer dereference and assertion failures in __nss_database_get
    (bug 28940) (RHEL-150269)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.2.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172543]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172543]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172543] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172543]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172543] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172543] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172543]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.3.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: Pavol Žáčik <pzacik@redhat.com> - 0.10.4-18
changelog:
  - Resolves: RHEL-150661
  - Resolves: CVE-2025-4877
  - Resolves: CVE-2025-4878
  - Resolves: CVE-2025-5351
  - Resolves: CVE-2025-8114
  - Resolves: CVE-2025-8277
  - Resolves: CVE-2026-0964
  - Resolves: CVE-2026-0965
  - Resolves: CVE-2026-0966
  - Resolves: CVE-2026-0967
  - Resolves: CVE-2026-0968


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164753
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166250
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166234
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166202
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166218


author: Pavol Žáčik <pzacik@redhat.com> - 1:3.5.1-4
changelog:
  - Make openssl speed test signatures without errors
    Resolves: RHEL-95502
  - Build tests in check and without LTO
    Resolves: RHEL-111633


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 1:3.5.5-1
changelog:
  - Rebase to OpenSSL 3.5.5
    Resolves: RHEL-136895
    Resolves: RHEL-142004
    Resolves: RHEL-142012
    Resolves: RHEL-142020
    Resolves: RHEL-142024
    Resolves: RHEL-142028
    Resolves: RHEL-142032
    Resolves: RHEL-142036
    Resolves: RHEL-142040
    Resolves: RHEL-142044
    Resolves: RHEL-142048
    Resolves: RHEL-142052
    Resolves: RHEL-142056


author: Jindrich Novy <jnovy@redhat.com> - 6:5.8.1-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.1
  - fixes podman restart policy `unless-stopped` does not behave exactly as `always` despite the man page saying they are identical - [RHEL-9.8] [0day]
  - Resolves: RHEL-157746


author: Jindrich Novy <jnovy@redhat.com> - 6:5.8.2-1
changelog:
  - update to https://github.com/containers/podman/releases/tag/v5.8.2
  - fixes CVE-2026-34986 go-jose: Go JOSE Denial of Service via crafted JWE
  - Resolves: RHEL-165040


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.12.13-1
changelog:
  - Update to 3.12.13
  - Security fixes for CVE-2025-6075, CVE-2025-13837, CVE-2025-15282, CVE-2025-59375, CVE-2026-0672
  Related: RHEL-168159, RHEL-167917


author: Charalampos Stratakis <cstratak@redhat.com> - 3.12.13-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-6100, CVE-2026-2297, CVE-2026-3644, CVE-2026-4224
  Resolves: RHEL-168159, RHEL-167917


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-4
changelog:
  - Security fixes for CVE-2026-0865, CVE-2025-15366, CVE-2025-15367 and CVE-2026-1299
  Resolves: RHEL-143117
  Resolves: RHEL-143174
  Resolves: RHEL-144897


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 3.9.25-5
changelog:
  - Rebuilding previous fixes for different build target
  Related: RHEL-143117, RHEL-143174, RHEL-144897


author: Peter Koprda <pkoprda@redhat.com> - 0.2.7-5
changelog:
  - Update yggdrasil to 0.2.7.2
  - Update yggdrasil-worker-package-manager to 0.1.3.2
  - Resolves: RHEL-169909
  - Resolves: CVE-2026-33186


author: Jindrich Novy <jnovy@redhat.com> - 1:1.22.2-1
changelog:
  - update to https://github.com/containers/skopeo/releases/tag/v1.22.2
  - fixes signature verification of images which only sign the per-platform
    manifest in skopeo proxy
  - Resolves: RHEL-168166


author: Alejandro López <allopez@redhat.com> - 1.9.17p2-3
changelog:
  - CVE-2026-35535 sudo: Privilege escalation due to failure in privilege drop calls
  Resolves: RHEL-166069


author: Petr Hybl <phybl@redhat.com> - 1:1.1.1k-5.2
changelog:
  - Fixes CVE-2025-69419 OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing
    Resolves: RHEL-142723


author: Pavol Žáčik <pzacik@redhat.com> - 1:1.1.1k-5.3
changelog:
  - Fixes CVE-2026-28390: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing
    Resolves: RHEL-165863


author: Jindrich Novy <jnovy@redhat.com> - 1.27-1
changelog:
  - update to https://github.com/containers/crun/releases/tag/1.27
  - fixes CVE-2026-30892 crun: crun: Privilege escalation due to incorrect parsing of the `--user` option [rhel-9.8]
  - Resolves: RHEL-161441


author: Petr Menšík <pemensik@redhat.com> - 2.85-18.1
changelog:
  - Prevent overflow in extract_name function (CVE-2026-2291)
  - Prevent DoS in DNSSEC validation (CVE-2026-4890)
  - Prevent out-of-bounds read in DNSSEC validation (CVE-2026-4891)
  - Prevent out-of-bounds write in DHCPv6 server (CVE-2026-4892)
  - Prevent source check avoidance by RFC 7871 client-subnet (CVE-2026-4893)


author: Michal Hlavinka <mhlavink@redhat.com> - 1:2.3.16-17
changelog:
  - fix CVE-2026-27858: denial of service via crafted message before authentication (RHEL-161640)
  - fix CVE-2025-59032: ManageSieve: Denial of Service via crafted SASL initial response in AUTHENTICATE command (RHEL-162288)
  - fix CVE-2026-27857: denial of service via specially crafted NOOP command (RHEL-161679)


author: Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.10.0-110.1
changelog:
  - bundled cryptography: replace with dependency to fix CVE-2026-26007
  - bundled PyJWT: upgrade to v2.12.1 to fix CVE-2026-32597
    Resolves: RHEL-167241, RHEL-155676


author: Jan Grulich <jgrulich@redhat.com> - 1.12.9-4.1
changelog:
  - Fix arbitrary code execution via crafted symlinks in sandbox-expose options
    Resolves: RHEL-165643
  - Fix arbitrary file deletion on host via improper cache file path validation
    Resolves: RHEL-170171


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.1
changelog:
  - Update CLEAR_VBAR_ENTRY size after alloc (CVE-2026-33984)
  - Fail progressive_rfx_quant_sub on invalid values (CVE-2026-33983)
    Resolves: RHEL-163097, RHEL-163113


author: Ondrej Holy <oholy@redhat.com> - 2:2.11.7-7.2
changelog:
  - Fix double free in xf_rail_window_common cleanup (CVE-2026-26986)
  - Fix growth of preallocated buffers (CVE-2026-27951)
  - Fix heap-buffer-overflow in bitmap_cache_put (CVE-2026-29775)
  - Add DSP format checks (CVE-2026-31884)
  - Fix DSP array bounds checks (CVE-2026-31883)
  - Fix DSP array bounds checks (CVE-2026-31885)
  - Update CLEAR_GLYPH_ENTRY::count after alloc (CVE-2026-33985)
    Resolves: RHEL-159816, RHEL-155478, RHEL-161047, RHEL-161482
    Resolves: RHEL-161519, RHEL-161085, RHEL-168463


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-4.4
changelog:
  - fix CVE-2026-4150 - align with Y-stream
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: Alexander Sosedkin <asosedkin@redhat.com> - 3.8.10-4
changelog:
  - Fix CVE-2026-33846 (DTLS fragment reassembly, High, heap overwrite)
  - Fix CVE-2026-42009 (DTLS fragment reassembly, High, undefined behaviour)
  - Fix CVE-2026-33845 (DTLS fragment reassembly, High, heap overread)
  - Fix CVE-2026-42010 (PSK authentication, High, authentication bypass)
  - Fix CVE-2026-3833 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42011 (Name constraints, Medium, name constraint bypass)
  - Fix CVE-2026-42012 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42013 (CN fallback, Medium, certificate misuse)
  - Fix CVE-2026-42014 (PKCS#11 PIN change, Medium, use-after-free)
  - Fix CVE-2026-5260 (PKCS#11 RSA, Medium, heap overread)
  - Fix CVE-2026-42015 (PKCS#12 appending, Low, heap overwrite)
  - Fix CVE-2026-3832 (OCSP, Low, revocation bypass)
  - Fix CVE-2026-5419 (PKCS#7, Low, timing side-channel)
  - Fix upstream security issue #1808 (PSK rehandshake)
  - Fix upstream security issue #1810 (EKU OID prefix match)
  - Fix upstream security issue #1813 (pkcs11-provider persistent keys)
  - Fix upstream security issue #1818 (RSA correctness, OpenSSL format import)
  - Fix upstream security issue #1819 (PKCS#11 trust removal error path)
  - Fix upstream security issue #1822 (SCT extension parser OOB read)
  - Fix upstream security issue #1841 (key zeroization in hybrid kex)
  - Fix upstream security issue #1823 (malformed certtool template)
  - Fix upstream security issue #1817 (session parameter loading robustness)
  - Fix upstream security issue #1820 (PKCS#11 KDF succeeding w/o deriving)
  - gnutls-3.8.10-CVE-2025-9820.patch: update Makefile.in


author: Sam Feifer <sfeifer@redhat.com> 10.2.6-22
changelog:
  - Resolves RHEL-161803: CVE-2026-27877
  - Resolves RHEL-166678: CVE-2026-32282
  - Resolves RHEL-167678: CVE-2026-32283


author: Luboš Uhliarik <luhliari@redhat.com> - 2.4.62-13.1
changelog:
  - Resolves: RHEL-173555 - httpd: Apache HTTP Server mod_proxy_ajp: Arbitrary
    code execution via heap-based buffer overflow (CVE-2026-28780)
  - Resolves: RHEL-175080 - httpd: NULL pointer dereference can cause a child
    process crash (CVE-2026-33007)
  - Resolves: RHEL-175100 - httpd: off-by-one out-of-bounds reads in AJP getter
    functions (CVE-2026-33857)
  - Resolves: RHEL-175028 - httpd: heap-based buffer over-read due to missing
    null-termination check (CVE-2026-34032)
  - Resolves: RHEL-175062 - httpd: heap-based buffer over-read and memory
    disclosure in ajp_parse_data() (CVE-2026-34059)


author: David Hanina <dhanina@redhat.com> - 4.13.1-3.1
changelog:
  - Resolves: RHEL-166865 Include latest fixes in python3-ipatests package [rhel-9.8.z]
  - Resolves: RHEL-155037 Pagure #9953: Adding a group with 32Bit Idrange fails. [rhel-9.8.z]
  - Resolves: RHEL-153146 IdM password policy Min lifetime is not enforced when high minlife is set [rhel-9.8.z]
  - Resolves: RHEL-168047 ipa ca-show ipa --all failing to list RSN version


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-145355
  - Create sub-package for xrealmauthz KDC plugin
    Resolves: RHEL-67468
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-145359


author: Julien Rische <jrische@redhat.com> - 1.21.1-10
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171590 RHEL-171596


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.1.el9_8
changelog:
  - conf: Parse hyperv features even for host-model (RHEL-151684)
  - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684)


author: Luboš Uhliarik <luhliari@redhat.com> - 2:1.26.3-9
changelog:
  - Resolves: RHEL-176218 - nginx:1.26/nginx: NGINX: Arbitrary Code Execution
    Vulnerability (CVE-2026-42945)


author: Luboš Uhliarik <luhliari@redhat.com> - 1:1.24.0-7.1
changelog:
  - Resolves: RHEL-176234 - nginx:1.24/nginx: NGINX: Arbitrary Code Execution
    Vulnerability (CVE-2026-42945)


author: Karolina Surma <ksurma@redhat.com> - 3.14.3-1
changelog:
  - Update to Python 3.14.3
  - Security fixes for CVE-2025-11468, CVE-2026-0672, CVE-2026-0865,
  CVE-2025-15282, CVE-2026-1299, CVE-2025-15366, CVE-2025-15367
  Resolves: RHEL-144896, RHEL-143115, RHEL-143173


author: Karolina Surma <ksurma@redhat.com> - 3.14.4-1
changelog:
  - Update to Python 3.14.4
  - Security fixes for CVE-2026-2297, CVE-2026-3644, CVE-2026-4224, CVE-2026-0865
  Related: RHEL-167918, RHEL-168160


author: Charalampos Stratakis <cstratak@redhat.com> - 3.14.4-2
changelog:
  - Security fixes for CVE-2026-1502, CVE-2026-4786, CVE-2026-5713, CVE-2026-6100
  Resolves: RHEL-167918, RHEL-168160


author: Zdenek Petracek <zpetrace@redhat.com> - 0.2.7-6
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2026-32283
  - Resolves: RHEL-167686
  - Resolves: CVE-2026-32282
  - Resolves: RHEL-166690


author: Stephen Bourke <sbourke@redhat.com> - 0.2.7-7
changelog:
  - Bump release for rebuild
  - Resolves: CVE-2026-32280
  - Resolves: RHEL-175431
  - Resolves: CVE-2026-32281
  - Resolves: RHEL-177312


author: Tomas Juhasz <tjuhasz@redhat.com> - 4.0.3-32
changelog:
  - Upgrade to Ruby 4.0.3.
    Resolves: RHEL-171933
  - Fix ERB: Arbitrary code execution via deserialization bypass
   (CVE-2026-41316)
    Resolves: RHEL-171258
  - Fix JSON: Denial of Service or Information Disclosure via format string injection
   (CVE-2026-33210)
   Resolves: RHEL-173458


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7
changelog:
  - Fix CVE-2025-62229: xorg-x11-server: Use-after-free in XPresentNotify structures creation
    Resolves: RHEL-119989

  - Fix CVE-2025-62230: xorg-x11-server: Use-after-free in Xkb client resource removal
    Resolves: RHEL-120009

  - Fix CVE-2025-62231: xorg-x11-server: Value overflow in Xkb extension XkbSetCompatMap()
    Resolves: RHEL-120770


author: Jan Grulich <jgrulich@redhat.com> - 1.15.0-7.1
changelog:
  - Fix CVE-2026-33999, CVE-2026-34000, CVE-2026-34001, CVE-2026-34002,
    CVE-2026-34003 xorg-x11-server: various XKB and XSYNC vulnerabilities
    Resolves: RHEL-163213
    Resolves: RHEL-163281
    Resolves: RHEL-163267
  - Fix CVE-2026-34352
    Resolves: RHEL-167986


author: Olivier Fourdan <ofourdan@redhat.com> - 1.20.11-34
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163226
    Resolves: https://redhat.atlassian.net/browse/RHEL-163308
    Resolves: https://redhat.atlassian.net/browse/RHEL-163239


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-3
changelog:
  - Fix a regression in Xwayland 24.1.9 with XTS test Xlib10
    Resolves: https://redhat.atlassian.net/browse/RHEL-170368


author: Olivier Fourdan <ofourdan@redhat.com> - 24.1.9-4
changelog:
  - CVE fix for: CVE-2026-33999, CVE-2026-34000, CVE-2026-34001
                 CVE-2026-34002, CVE-2026-34003
    Resolves: https://redhat.atlassian.net/browse/RHEL-163199
    Resolves: https://redhat.atlassian.net/browse/RHEL-163295
    Resolves: https://redhat.atlassian.net/browse/RHEL-163253


author: Jan Grulich <jgrulich@redhat.com> - 0.6.22-6.1
changelog:
  - Fix integer underflow in MakerNote decoding (CVE-2026-40386)
  - Fix integer overflow in Nikon MakerNote handling (CVE-2026-40385)
    Resolves: RHEL-170253, RHEL-170234


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Luboš Uhliarik <luhliari@redhat.com> - 2.0.26-6
changelog:
  - Resolves: RHEL-166293 - httpd: Apache HTTP Server: HTTP/2 DoS by Memory
    Increase (CVE-2025-53020)


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.0.0-5
changelog:
  - Emulate a zero axis events after REL_WHEEL (RHEL-153540)
  - Fix ToolSerials assignment for serials greater than INT_MAX (RHEL-153532)


author: Zdenek Dohnal <zdohnal@redhat.com> - 2:8.2.2637-26.5
changelog:
  - RHEL-170136 CVE-2026-35177 vim: Vim zip.vim plugin: Arbitrary file overwrite
    via path traversal bypass


