# changelog

author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601282121.p0.g0d0943b.assembly.4.21.0
changelog:
  - Update to source commit https://github.com/openshift/microshift/commit/0d0943b44d5a86db47b19b50f37f5d7881967868


author: Jindrich Novy <jnovy@redhat.com> - 3:2.229.0-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.229.0
  - Related: RHEL-2112


author: Peter Hunt <pehunt@redhat.com> - 3:2.231.0-6.rhaos4.18
changelog:
  - carry https://github.com/containers/container-selinux/pull/329 as well
  - but only the policy change, not the version change


author: Jindrich Novy <jnovy@redhat.com> - 3:2.234.2-1
changelog:
  - update to https://github.com/containers/container-selinux/releases/tag/v2.234.2
  - Related: USHIFT-3173


author: Andrew McDermott <amcdermo@redhat.com> - 2.8.5-1.rhaos4.16
changelog:
  - Bump to 2.8.5
  - Delete existing carry patches related to 2.6
  - Carry fix for https://github.com/haproxy/haproxy/issues/2403
  - Fix for issue 2403 picked from https://git.haproxy.org/?p=haproxy-2.9.git;a=commit;h=bef2bc4cb6f4fa942d3659f25770cbfc137327b2
  - Resolves https://issues.redhat.com/browse/NE-1444


author: Andrew McDermott <amcdermo@redhat.com> - 2.8.5-2.rhaos4.16
changelog:
  - Resolve https://issues.redhat.com/browse/OCPBUGS-32369 (HAProxy consuming high cpu usage)
  - Carry fix for https://github.com/haproxy/haproxy/issues/2537
  - Fix for issue 2537 picked from https://git.haproxy.org/?p=haproxy.git;a=commit;h=4a9e3e102e192b9efd17e3241a6cc659afb7e7dc


author: Andrew McDermott <amcdermo@redhat.com> - 2.8.10-1.rhaos4.17
changelog:
  - Resolves https://issues.redhat.com/browse/NE-1761.
  - Drop old carry patches.
  - haproxy.spec: Optionally enable debug builds


author: Andrey Lebedev <alebedev@redhat.com> - 2.8.10-1.rhaos4.17
changelog:
  - Resolves https://issues.redhat.com/browse/OCPBUGS-60885.
  - Fixes excessive CPU usage when using 4096-bit RSA keys.
  - Backports the upstream fix for https://github.com/haproxy/haproxy/issues/3124.
  - Cherry-picked upstream commit1: http://git.haproxy.org/?p=haproxy.git;a=commit;h=7ea80cc5b66e9a9e8e5618532f1c6deb93385761.
  - Cherry-picked upstream commit2: http://git.haproxy.org/?p=haproxy.git;a=commit;h=1afaa7b59d6c407d68683b821f3142654a37b17e.
  - Behavior is enabled only when "option abortonclose" is set.


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g52351d6.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/52351d68ef76ea7ad374e31ae1afb32e1d132c97


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g75653ac.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/openshift-ansible/commit/75653ac296666ef399254d5d0bfd9c3fc98be0c0


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g345800d.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/345800dc3c4164fbca313c1cbfb383f262547903


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g3365bc9.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-aws/commit/3365bc9ca5b116c63c1c90130c017f3496a139a1


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g83b3f9e.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-azure/commit/83b3f9ec7df408c3d53d5f8e6fe84e0bdd4398e8


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g2a5bd7e.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/crio-credential-provider/commit/2a5bd7ea1eb91d1a6930941ea1441c6e555ac3a6


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601070814.p2.g8732386.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-gcp/commit/8732386c3ddcb98dae624f7bb925ed0ef8d077d5


author: Jindrich Novy <jnovy@redhat.com> - 5:5.2.2-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.2-rhel
    (https://github.com/containers/podman/commit/d3d8756)
  - Related: OCPBUGS-42897


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-1
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/45c2d1f)
  - fixes "CVE-2025-27144 podman: Go JOSE's Parsing Vulnerable to Denial of Service [openshift-4.19]"
  - Resolves: OCPBUGS-52932


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-2.rhaos4.19
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9ad4842)
  - fixes "CVE-2025-22869 podman: Denial of Service in the Key Exchange of golang.org/x/crypto/ssh [openshift-4.19]"
  - Resolves: OCPBUGS-52552


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-10.rhaos4.20
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/9811294)
  - fixes "CVE-2025-6032 podman: podman missing TLS verification [openshift-4.20]"
  - Resolves: OCPBUGS-57408


author: Jindrich Novy <jnovy@redhat.com> - 5:5.4.0-11.rhaos4.21
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v5.4-rhel
    (https://github.com/containers/podman/commit/b0d88c7)
  - fixes "CVE-2025-9566 podman: Podman kube play command may overwrite host files [openshift-4.20]"
  - Related: OCPBUGS-61270


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202602041753.p2.g0df3535.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/0df353502309af2497270ddf993bb866e2f2b5a9


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601170322.p2.g19a2243.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/19a2243fe780f1aa9b5c8d80bd413a8721cc2e8c


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202601151825.p2.g41ac31f.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/crio-credential-provider/commit/41ac31f52b8e0e264040e762cbc137efcd9cc851


author: Roberto Bergantinos Corpas <rbergant@redhat.com> [5.14.0-570.79.1.el9_6]
changelog:
  - nbd: override creds to kernel when calling sock_{send,recv}msg() (Ming Lei) [RHEL-123844]
  - ALSA: ump: Fix buffer overflow at UMP SysEx message conversion (Arif Badar) [RHEL-132725] {CVE-2025-37891}
  - ASoC: Intel: bytcr_rt5640: Fix invalid quirk input mapping (CKI Backport Bot) [RHEL-129111] {CVE-2025-40154}
  - NFSD: Fix callback decoder status codes (Jay Shin) [RHEL-127658]
  - NFSD: Fix CB_GETATTR status fix (Jay Shin) [RHEL-127658]
  - NFSD: fix hang in nfsd4_shutdown_callback (Jay Shin) [RHEL-127666] {CVE-2025-21795}
  - NFSD: fix decoding in nfs4_xdr_dec_cb_getattr (Jay Shin) [RHEL-127658]
  - KVM: arm64: Tear down vGIC on failed vCPU creation (Malaya Kumar Rout) [RHEL-129663] {CVE-2025-37849}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.80.1.el9_6]
changelog:
  - irqchip/gic-v2m: Prevent use after free of gicv2m_get_fwnode() (CKI Backport Bot) [RHEL-131971] {CVE-2025-37819}
  - ntb_hw_switchtec: Fix shift-out-of-bounds in switchtec_ntb_mw_set_trans (CKI Backport Bot) [RHEL-132888] {CVE-2023-53034}
  - net: openvswitch: fix nested key length validation in the set() action (CKI Backport Bot) [RHEL-131803] {CVE-2025-37789}
  - mptcp: fix race condition in mptcp_schedule_work() (CKI Backport Bot) [RHEL-134447] {CVE-2025-40258}
  - drm/vmwgfx: Validate command header size against SVGA_CMD_MAX_DATASIZE (CKI Backport Bot) [RHEL-134427] {CVE-2025-40277}
  - Bluetooth: ISO: Fix possible UAF on iso_conn_free (CKI Backport Bot) [RHEL-128888] {CVE-2025-40141}
  - drm/xe: Use local fence in error path of xe_migrate_clear (Xiubo Li) [RHEL-131994] {CVE-2025-37869}
  - drm/xe: Fix an out-of-bounds shift when invalidating TLB (Xiubo Li) [RHEL-129972] {CVE-2025-37761}
  - s390/ism: fix concurrency management in ism_cmd() (CKI Backport Bot) [RHEL-114497]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.81.1.el9_6]
changelog:
  - devlink: rate: Unset parent pointer in devl_rate_nodes_destroy (Xiubo Li) [RHEL-134922] {CVE-2025-40251}
  - Bluetooth: hci_sync: fix race in hci_cmd_sync_dequeue_once (CKI Backport Bot) [RHEL-136255] {CVE-2025-40318}
  - scsi: lpfc: Avoid potential ndlp use-after-free in dev_loss_tmo_callbk (Dick Kennedy) [RHEL-138046] {CVE-2025-38289}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.82.1.el9_6]
changelog:
  - io_uring: prevent opcode speculation (CKI KWF BOT) [RHEL-141478] {CVE-2025-21863}
  - tools/power turbostat: Add initial support for ClearwaterForest (David Arcari) [RHEL-138242]
  - net: atlantic: fix fragment overflow handling in RX path (CKI KWF BOT) [RHEL-139486] {CVE-2025-68301}
  - tty: n_tty: Fix buffer offsets when lookahead is used (Radostin Stoyanov) [RHEL-130035]
  - thermal: core: Change PM notifier priority to the minimum (Luis Claudio R. Goncalves) [RHEL-100435]
  - thermal: core: Synchronize suspend-prepare and post-suspend actions (Luis Claudio R. Goncalves) [RHEL-100435]
  - sched/core: Fix migrate_swap() vs. hotplug (Luis Claudio R. Goncalves) [RHEL-100435]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.84.1.el9_6]
changelog:
  - vsock: Ignore signal/timeout on connect() if already established (CKI Backport Bot) [RHEL-139283] {CVE-2025-40248}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.85.1.el9_6]
changelog:
  - iommu/vt-d: Deduplicate cache_tag_flush_all by reusing flush_range (Jerry Snitselaar) [RHEL-144216]
  - iommu/vt-d: Fix missing PASID in dev TLB flush with cache_tag_flush_all (Jerry Snitselaar) [RHEL-144216]
  - s390/mm: Fix __ptep_rdp() inline assembly (CKI Backport Bot) [RHEL-143712]
  - fbdev: bitblit: bound-check glyph index in bit_putcs* (CKI Backport Bot) [RHEL-136941] {CVE-2025-40322}
  - sched: sch_cake: add bounds checks to host bulk flow fairness counts (CKI KWF BOT) [RHEL-141468] {CVE-2025-21647}
  - vrf: use RCU protection in l3mdev_l3_out() (CKI KWF BOT) [RHEL-141472] {CVE-2025-21791}
  - ACPI: PRM: Reduce unnecessary printing to avoid user confusion (Mark Langsdorf) [RHEL-116417]
  - NFS: Fix potential buffer overflowin nfs_sysfs_link_rpc_client() (CKI Backport Bot) [RHEL-141456] {CVE-2024-54456}
  - workqueue: Put the pwq after detaching the rescuer from the pool (CKI KWF BOT) [RHEL-140030] {CVE-2025-21786}
  - dpll: zl3073x: Remove unused dev wrappers (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Cache all output properties in zl3073x_out (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Cache all reference properties in zl3073x_ref (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Cache reference monitor status (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Split ref, out, and synth logic from core (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Store raw register values instead of parsed state (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: fix kernel-doc name and missing parameter in fw.c (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Fix output pin registration (Ivan Vecera) [RHEL-139697]
  - dpll: fix device-id-get and pin-id-get to return errors properly (Ivan Vecera) [RHEL-139697]
  - dpll: spec: add missing module-name and clock-id to pin-get reply (Ivan Vecera) [RHEL-139697]
  - dpll: zl3073x: Allow to configure phase offset averaging factor (Ivan Vecera) [RHEL-139697]
  - dpll: add phase_offset_avg_factor_get/set callback ops (Ivan Vecera) [RHEL-139697]
  - dpll: add phase-offset-avg-factor device attribute to netlink spec (Ivan Vecera) [RHEL-139697]
  - dpll: add reference sync get/set (Ivan Vecera) [RHEL-139697]
  - dpll: add reference-sync netlink attribute (Ivan Vecera) [RHEL-139697]
  - netlink: specs: dpll: replace underscores with dashes in names (Ivan Vecera) [RHEL-139697]
  - dpll: remove documentation of rclk_dev_name (Ivan Vecera) [RHEL-139697]
  - dpll: fix xa_alloc_cyclic() error handling (Ivan Vecera) [RHEL-139697]
  - dpll: Add an assertion to check freq_supported_num (Ivan Vecera) [RHEL-139697]
  - md: avoid repeated calls to del_gendisk (Nigel Croxon) [RHEL-126531]
  - md: delete mddev kobj before deleting gendisk kobj (Nigel Croxon) [RHEL-126531]
  - md: add legacy_async_del_gendisk mode (Nigel Croxon) [RHEL-126531]
  - md: Don't clear MD_CLOSING until mddev is freed (Nigel Croxon) [RHEL-126531]
  - md: fix create on open mddev lifetime regression (Nigel Croxon) [RHEL-126531]
  - md: call del_gendisk in control path (Nigel Croxon) [RHEL-126531]
  - RDMA/core: Fix "KASAN: slab-use-after-free Read in ib_register_device" problem (Xiubo Li) [RHEL-134355] {CVE-2025-38022}
  - nvme: tcp: Fix compilation warning with W=1 (John Meneghini) [RHEL-129927]
  - nvme-tcp: Fix I/O queue cpu spreading for multiple controllers (John Meneghini) [RHEL-129927]
  - smb: client: Fix use-after-free in cifs_fill_dirent (CKI Backport Bot) [RHEL-134377] {CVE-2025-38051}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.86.1.el9_6]
changelog:
  - Bluetooth: MGMT: Fix OOB access in parse_adv_monitor_pattern() (CKI Backport Bot) [RHEL-136962] {CVE-2025-40294}
  - NFSv4/pNFS: Clear NFS_INO_LAYOUTCOMMIT in pnfs_mark_layout_stateid_invalid (CKI Backport Bot) [RHEL-140259] {CVE-2025-68349}
  - net/sched: mqprio: fix stack out-of-bounds write in tc entry parsing (CKI Backport Bot) [RHEL-136818] {CVE-2025-38568}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.87.1.el9_6]
changelog:
  - io_uring/net: commit partial buffers on retry (Jeff Moyer) [RHEL-137332] {CVE-2025-38730}
  - io_uring/kbuf: add io_kbuf_commit() helper (Jeff Moyer) [RHEL-137332]
  - io_uring/kbuf: use 'bl' directly rather than req->buf_list (Jeff Moyer) [RHEL-137332]
  - fbdev: Add bounds checking in bit_putcs to fix vmalloc-out-of-bounds (CKI Backport Bot) [RHEL-137682] {CVE-2025-40304}
  - net: openvswitch: Avoid needlessly taking the RTNL on vport destroy (Adrian Moreno) [RHEL-141403]
  - fs/proc: fix uaf in proc_readdir_de() (CKI Backport Bot) [RHEL-137097] {CVE-2025-40271}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.88.1.el9_6]
changelog:
  - scsi: qla2xxx: Fix bsg_done() causing double free (Ewan D. Milne) [RHEL-146048]
  - s390/pci: Allow automatic recovery with minimal driver support (CKI Backport Bot) [RHEL-118880]
  - ALSA: usb-audio: Fix potential overflow of PCM transfer buffer (Piyush Thange) [RHEL-136908] {CVE-2025-40269}
  - x86/sev: Guard sev_evict_cache() with CONFIG_AMD_MEM_ENCRYPT (Paolo Bonzini) [RHEL-128029]
  - x86/sev: Evict cache lines during SNP memory validation (Paolo Bonzini) [RHEL-128029]
  - net: vxlan: prevent NULL deref in vxlan_xmit_one (Arif Badar) [RHEL-133368]
  - smb: client: let recv_done verify data_offset, data_length and remaining_data_length (CKI Backport Bot) [RHEL-131390] {CVE-2025-39933}
  - usb: xhci: Fix isochronous Ring Underrun/Overrun event handling (Xiubo Li) [RHEL-132022] {CVE-2025-37882}
  - i40e: add rh_phys_port_name mod option to behave like upstream (Xiubo Li) [RHEL-128236]
  - ice: add rh_phys_port_name mod option to behave like upstream (Xiubo Li) [RHEL-128236]


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202602101124.p2.g83d4961.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/crio-credential-provider/commit/83d4961cee137f764e5ef11b7b4301e0496dfa89


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.89.1.el9_6]
changelog:
  - eventpoll: don't decrement ep refcount while still holding the ep mutex (CKI Backport Bot) [RHEL-138034] {CVE-2025-38349}
  - usb: core: config: Prevent OOB read in SS endpoint companion parsing (CKI Backport Bot) [RHEL-137366] {CVE-2025-39760}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.90.1.el9_6]
changelog:
  - ice: PTP: fix missing timestamps on E825 hardware (CKI Backport Bot) [RHEL-148165]
  - dpll: expose fractional frequency offset in ppt (Ivan Vecera) [RHEL-146356]
  - dpll: zl3073x: Implement device mode setting support (Ivan Vecera) [RHEL-147458]
  - dpll: add dpll_device op to set working mode (Ivan Vecera) [RHEL-147458]
  - dpll: add dpll_device op to get supported modes (Ivan Vecera) [RHEL-147458]
  - squashfs: fix memory leak in squashfs_fill_super (CKI Backport Bot) [RHEL-138017] {CVE-2025-38415}
  - Squashfs: check return result of sb_min_blocksize (CKI Backport Bot) [RHEL-138017] {CVE-2025-38415}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.91.1.el9_6]
changelog:
  - io_uring/sqpoll: don't put task_struct on tctx setup failure (Jeff Moyer) [RHEL-137990]
  - io_uring: consistently use rcu semantics with sqpoll thread (Jeff Moyer) [RHEL-137990]
  - io_uring: fix use-after-free of sq->thread in __io_uring_show_fdinfo() (Jeff Moyer) [RHEL-137990] {CVE-2025-38106}
  - io_uring/sqpoll: fix sqpoll error handling races (Jeff Moyer) [RHEL-137990]
  - io_uring/sqpoll: annotate debug task == current with data_race() (Jeff Moyer) [RHEL-137990]
  - NFS: remove revoked delegation from server's delegation list (CKI Backport Bot) [RHEL-134236]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.92.1.el9_6]
changelog:
  - scsi: mpi3mr: Synchronous access b/w reset and tm thread for reply queue (Chandrakanth Patil) [RHEL-132218] {CVE-2025-37861}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.93.1.el9_6]
changelog:
  - scsi: s390: zfcp: Ensure synchronous unit_add (CKI Backport Bot) [RHEL-143735]
  - ACPI: processor: idle: Return an error if both P_LVL{2,3} idle states are invalid (Mark Langsdorf) [RHEL-118728]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.94.1.el9_6]
changelog:
  - bpf, sockmap: Avoid using sk_socket after free when sending (Piyush Thange) [RHEL-137960] {CVE-2025-38154}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202602241604.p2.g1dcb406.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/1dcb406c2ca2033c3a01617372afbfe8bf09ac71


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202602241604.p2.g6a13cc7.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/6a13cc70a1c232f6e566fa7f155b54b0a7d75bfe


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.95.1.el9_6]
changelog:
  - i40e: validate ring_len parameter against hardware-specific values (Arif Badar) [RHEL-141721]
  - mm/hugetlb: ignore hugepage kernel args if hugepages are unsupported (CKI Backport Bot) [RHEL-144088]
  - md/md-bitmap: fix GPF in bitmap_get_stats() (Nigel Croxon) [RHEL-118895]
  - md/md-bitmap: fix stats collection for external bitmaps (Nigel Croxon) [RHEL-118895]
  - md/md-bitmap: Synchronize bitmap_get_stats() with bitmap lifetime (Nigel Croxon) [RHEL-118895]
  - md/raid1: fix data lost for writemostly rdev (CKI Backport Bot) [RHEL-143623]
  - net: af_can: do not leave a dangling sk pointer in can_create() (CKI KWF BOT) [RHEL-141464] {CVE-2024-56603}
  - page_pool: Fix use-after-free in page_pool_recycle_in_ring (CKI Backport Bot) [RHEL-137842] {CVE-2025-38129}
  - drm/xe: Make dma-fences compliant with the safe access rules (Marc Milgram) [RHEL-122267] {CVE-2025-38703}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.96.1.el9_6]
changelog:
  - dm: fix dm_blk_report_zones (CKI Backport Bot) [RHEL-137951] {CVE-2025-38141}
  - netfilter: nft_tunnel: fix geneve_opt type confusion addition (CKI KWF BOT) [RHEL-141477] {CVE-2025-22056}
  - RDMA/rxe: Fix slab-use-after-free Read in rxe_queue_cleanup bug (CKI Backport Bot) [RHEL-137068] {CVE-2025-38024}
  - x86/tdx: Fix "in-kernel MMIO" check (Vitaly Kuznetsov) [RHEL-131698] {CVE-2024-47727}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202602280320.p2.g56a56a3.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/56a56a3a76474ed4329fff4fc9958e2c60c3ab3f


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.97.1.el9_6]
changelog:
  - exfat: fix double free in delayed_free (CKI KWF BOT) [RHEL-146402] {CVE-2025-38206}
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143543] {CVE-2025-71085}
  - RDMA/rxe: Fix the qp flush warnings in req (CKI KWF BOT) [RHEL-141452] {CVE-2024-53229}
  - inetpeer: do not get a refcount in inet_getpeer() (CKI Backport Bot) [RHEL-116120]
  - inetpeer: update inetpeer timestamp in inet_getpeer() (CKI Backport Bot) [RHEL-116120]
  - inetpeer: remove create argument of inet_getpeer() (CKI Backport Bot) [RHEL-116120]
  - inetpeer: remove create argument of inet_getpeer_v[46]() (CKI Backport Bot) [RHEL-116120]
  - ipv4/route: avoid unused-but-set-variable warning (CKI Backport Bot) [RHEL-116120]
  - Set fc_nlinfo in nh_create_ipv4, nh_create_ipv6 (Guillaume Nault) [RHEL-138492]
  - uprobes: Fix race in uprobe_free_utask (Jay Shin) [RHEL-133871]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.98.1.el9_6]
changelog:
  - sctp: avoid NULL dereference when chunk data buffer is missing (CKI KWF BOT) [RHEL-150190] {CVE-2025-40240}
  - perf test: Ensure lock contention using pipe mode (Michael Petlan) [RHEL-141703]
  - svcrdma: use rc_pageoff for memcpy byte offset (CKI Backport Bot) [RHEL-142789] {CVE-2025-68811}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.7-202603230928.p0.g238410b.assembly.4.21.7
changelog:
  - Update to source commit https://github.com/openshift/microshift/commit/238410b75e9c8db106d6df6d30e0bd60549e6c0c


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.99.1.el9_6]
changelog:
  - s390: Disable ARCH_WANT_OPTIMIZE_HUGETLB_VMEMMAP (Marc Milgram) [RHEL-137202]
  - s390: mm: add stub for hugetlb_optimize_vmemmap_key (Luiz Capitulino) [RHEL-137202]
  - dpll: zl3073x: Fix output pin phase adjustment sign (CKI Backport Bot) [RHEL-149763]
  - macvlan: fix possible UAF in macvlan_forward_source() (CKI Backport Bot) [RHEL-144124] {CVE-2026-23001}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.100.1.el9_6]
changelog:
  - bridge: mcast: Fix use-after-free during router port configuration (CKI Backport Bot) [RHEL-138431] {CVE-2025-38248}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202603122223.p2.g8b1d67b.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/8b1d67b459cd554cd4b6d878e9bf4d425b3bf9a0


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202603171946.p2.gfdc7f3f.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-aws/commit/fdc7f3f15c693593cb573b6bef6f0363256b6f52


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.101.1.el9_6]
changelog:
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - can: j1939: j1939_session_destroy(): fix memory leak of skbs (Davide Caratti) [RHEL-141465]
  - can: j1939: j1939_session_new(): fix skb reference counting (CKI KWF BOT) [RHEL-141465] {CVE-2024-56645}
  - drm/sched: Fix potential double free in drm_sched_job_add_resv_dependencies (Mika Penttilä) [RHEL-125463] {CVE-2025-40096}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.102.1.el9_6]
changelog:
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Arif Badar) [RHEL-150225]
  - macvlan: fix error recovery in macvlan_common_newlink() (Arif Badar) [RHEL-150225] {CVE-2026-23209}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-149473] {CVE-2025-22075}
  - ice: fix adding AQ LLDP filter for VF (Ivan Vecera) [RHEL-143686]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-143686]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Ivan Vecera) [RHEL-143686]
  - ice: dpll: fix rclk pin state get and misplaced header macros (Ivan Vecera) [RHEL-148558]
  - ice: dpll: Support E825-C SyncE and dynamic pin discovery (Ivan Vecera) [RHEL-148558]
  - drivers: Add support for DPLL reference count tracking (Ivan Vecera) [RHEL-148558]
  - redhat: configs: Enable CONFIG_DPLL_REFCNT_TRACKER for debug (Ivan Vecera) [RHEL-148558]
  - dpll: Add reference count tracking support (Ivan Vecera) [RHEL-148558]
  - dpll: Enhance and consolidate reference counting logic (Ivan Vecera) [RHEL-148558]
  - dpll: zl3073x: Add support for mux pin type (Ivan Vecera) [RHEL-148558]
  - dpll: Support dynamic pin index allocation (Ivan Vecera) [RHEL-148558]
  - dpll: Add notifier chain for dpll events (Ivan Vecera) [RHEL-148558]
  - dpll: zl3073x: Associate pin with fwnode handle (Ivan Vecera) [RHEL-148558]
  - dpll: Allow associating dpll pin with a firmware node (Ivan Vecera) [RHEL-148558]
  - ice: fix devlink reload call trace (Michal Schmidt) [RHEL-143686]
  - ice: add missing ice_deinit_hw() in devlink reinit path (Michal Schmidt) [RHEL-143686]
  - ice: Fix persistent failure in ice_get_rxfh (Michal Schmidt) [RHEL-143686]
  - ice: Fix incorrect timeout ice_release_res() (Michal Schmidt) [RHEL-143686]
  - ice: Avoid detrimental cleanup for bond during interface stop (Michal Schmidt) [RHEL-143686]
  - ice: initialize ring_stats->syncp (Michal Schmidt) [RHEL-143686]
  - ice: remove duplicate call to ice_deinit_hw() on error paths (Michal Schmidt) [RHEL-143686]
  - ice: move ice_deinit_dev() to the end of deinit paths (Michal Schmidt) [RHEL-143686]
  - ice: extract ice_init_dev() from ice_init() (Michal Schmidt) [RHEL-143686]
  - ice: move ice_init_pf() out of ice_init_dev() (Michal Schmidt) [RHEL-143686]
  - ice: move udp_tunnel_nic and misc IRQ setup into ice_init_pf() (Michal Schmidt) [RHEL-143686]
  - iavf: add RSS support for GTP protocol via ethtool (Michal Schmidt) [RHEL-143686]
  - ice: implement GTP RSS context tracking and configuration (Michal Schmidt) [RHEL-143686]
  - ice: add virtchnl definitions and static data for GTP RSS (Michal Schmidt) [RHEL-143686]
  - ice: ice_init_pf: destroy mutexes and xarrays on memory alloc failure (Michal Schmidt) [RHEL-143686]
  - ice: refactor to use helpers (Michal Schmidt) [RHEL-143686]
  - ice: add E830 Earliest TxTime First Offload support (Michal Schmidt) [RHEL-143686]
  - ice, libie: move fwlog code to libie (Michal Schmidt) [RHEL-143686]
  - iavf: fix off-by-one issues in iavf_config_rss_reg() (Michal Schmidt) [RHEL-143686] {CVE-2025-71087}
  - iavf: clarify VLAN add/delete log messages and lower log level (Michal Schmidt) [RHEL-143686]
  - ice: fix comment typo and correct module format string (Michal Schmidt) [RHEL-143686]
  - ice: fix PTP cleanup on driver removal in error path (Michal Schmidt) [RHEL-143686] {CVE-2025-68215}
  - ice: Extend PTYPE bitmap coverage for GTP encapsulated flows (Michal Schmidt) [RHEL-143686]
  - ice: improve TCAM priority handling for RSS profiles (Michal Schmidt) [RHEL-143686]
  - ice: add flow parsing for GTP and new protocol field support (Michal Schmidt) [RHEL-143686]
  - ice: Allow 100M speed for E825C SGMII device (Michal Schmidt) [RHEL-143686]
  - ice: fix usage of logical PF id (Michal Schmidt) [RHEL-143686]
  - ice: fix destination CGU for dual complex E825 (Michal Schmidt) [RHEL-143686]
  - ice: fix lane number calculation (Michal Schmidt) [RHEL-143686]
  - ice: move ice_init_interrupt_scheme() prior ice_init_pf() (Michal Schmidt) [RHEL-143686]
  - ice: move service task start out of ice_init_pf() (Michal Schmidt) [RHEL-143686]
  - ice: enforce RTNL assumption of queue NAPI manipulation (Michal Schmidt) [RHEL-143686]
  - ice: implement transmit hardware timestamp statistics (Michal Schmidt) [RHEL-143686]
  - ice: add tracking of good transmit timestamps (Michal Schmidt) [RHEL-143686]
  - ice: implement ethtool standard stats (Michal Schmidt) [RHEL-143686]
  - libie: fix string names for AQ error codes (Michal Schmidt) [RHEL-143686]
  - iavf: fix proper type for error code in iavf_resume() (Michal Schmidt) [RHEL-143686]
  - ice: Remove deprecated ice_lag_move_new_vf_nodes() call (Michal Schmidt) [RHEL-143686]
  - ice: move ice_qp_[ena|dis] for reuse (Michal Schmidt) [RHEL-143686]
  - ice: reregister fwlog after driver reinit (Michal Schmidt) [RHEL-143686]
  - ice: prepare for moving file to libie (Michal Schmidt) [RHEL-143686]
  - ice: move debugfs code to fwlog (Michal Schmidt) [RHEL-143686]
  - libie, ice: move fwlog admin queue to libie (Michal Schmidt) [RHEL-143686]
  - ice: drop driver specific structure from fwlog code (Michal Schmidt) [RHEL-143686]
  - ice: check for PF number outside the fwlog code (Michal Schmidt) [RHEL-143686]
  - ice: move out debugfs init from fwlog (Michal Schmidt) [RHEL-143686]
  - ice: allow calling custom send function in fwlog (Michal Schmidt) [RHEL-143686]
  - ice: add pdev into fwlog structure and use it for logging (Michal Schmidt) [RHEL-143686]
  - ice: introduce ice_fwlog structure (Michal Schmidt) [RHEL-143686]
  - ice: drop ice_pf_fwlog_update_module() (Michal Schmidt) [RHEL-143686]
  - ice: move get_fwlog_data() to fwlog file (Michal Schmidt) [RHEL-143686]
  - ice: make fwlog functions static (Michal Schmidt) [RHEL-143686]
  - ice: finish virtchnl.c split into rss.c (Michal Schmidt) [RHEL-143686]
  - ice: extract virt/rss.c: cleanup - p2 (Michal Schmidt) [RHEL-143686]
  - ice: extract virt/rss.c: cleanup - p1 (Michal Schmidt) [RHEL-143686]
  - ice: split RSS stuff out of virtchnl.c - copy back (Michal Schmidt) [RHEL-143686]
  - ice: split RSS stuff out of virtchnl.c - tmp rename (Michal Schmidt) [RHEL-143686]
  - ice: finish virtchnl.c split into queues.c (Michal Schmidt) [RHEL-143686]
  - ice: extract virt/queues.c: cleanup - p3 (Michal Schmidt) [RHEL-143686]
  - ice: extract virt/queues.c: cleanup - p2 (Michal Schmidt) [RHEL-143686]
  - ice: extract virt/queues.c: cleanup - p1 (Michal Schmidt) [RHEL-143686]
  - ice: split queue stuff out of virtchnl.c - copy back (Michal Schmidt) [RHEL-143686]
  - ice: split queue stuff out of virtchnl.c - tmp rename (Michal Schmidt) [RHEL-143686]
  - ice: fix incorrect counter for buffer allocation failures (Michal Schmidt) [RHEL-143686]
  - ice: add virt/ and move ice_virtchnl* files there (Michal Schmidt) [RHEL-143686]
  - ice: Implement support for SRIOV VFs across Active/Active bonds (Michal Schmidt) [RHEL-143686]
  - ice: cleanup capabilities evaluation (Michal Schmidt) [RHEL-143686]
  - ice: Cleanup variable initialization in LAG code (Michal Schmidt) [RHEL-143686]
  - ice: move LAG function in code to prepare for Active-Active (Michal Schmidt) [RHEL-143686]
  - ice: Add driver specific prefix to LAG defines (Michal Schmidt) [RHEL-143686]
  - ice: replace u8 elements with bool where appropriate (Michal Schmidt) [RHEL-143686]
  - ice: Remove casts on void pointers in LAG code (Michal Schmidt) [RHEL-143686]
  - ice: Don't use %pK through printk or tracepoints (Michal Schmidt) [RHEL-143686]
  - net: Fix typos [partial:ice] (Michal Schmidt) [RHEL-143686]
  - iavf: use libie_aq_str (Michal Schmidt) [RHEL-143686]
  - ice: use libie_aq_str (Michal Schmidt) [RHEL-143686]
  - libie: add adminq helper for converting err to str (Michal Schmidt) [RHEL-143686]
  - iavf: use libie adminq descriptors (Michal Schmidt) [RHEL-143686]
  - i40e: use libie adminq descriptors [partial:ice,libie] (Michal Schmidt) [RHEL-143686]
  - ixgbe: use libie adminq descriptors [partial:libie] (Michal Schmidt) [RHEL-143686]
  - ice, libie: move generic adminq descriptors to lib (Michal Schmidt) [RHEL-143686]
  - ice: Fix a null pointer dereference in ice_copy_and_init_pkg() (Michal Schmidt) [RHEL-143686] {CVE-2025-38664}
  - ice: breakout common LAG code into helpers (Michal Schmidt) [RHEL-143686]
  - ice: convert ice_add_prof() to bitmap (Michal Schmidt) [RHEL-143686]
  - ice: add E835 device IDs (Michal Schmidt) [RHEL-143686]
  - ice: add 40G speed to Admin Command GET PORT OPTION (Michal Schmidt) [RHEL-143686]
  - ice: check correct pointer in fwlog debugfs (Michal Schmidt) [RHEL-143686]
  - ice: add NULL check in eswitch lag check (Michal Schmidt) [RHEL-143686] {CVE-2025-38526}
  - ice: introduce ice_get_vf_by_dev() wrapper (Michal Schmidt) [RHEL-143686]
  - ice: avoid rebuilding if MSI-X vector count is unchanged (Michal Schmidt) [RHEL-143686]
  - ice: use pci_iov_vf_id() to get VF ID (Michal Schmidt) [RHEL-143686]
  - ice: expose VF functions used by live migration (Michal Schmidt) [RHEL-143686]
  - ice: move ice_vsi_update_l2tsel to ice_lib.c (Michal Schmidt) [RHEL-143686]
  - ice: save RSS hash configuration for migration (Michal Schmidt) [RHEL-143686]
  - ice: add functions to get and set Tx queue context (Michal Schmidt) [RHEL-143686]
  - ice: add support for reading and unpacking Rx queue context (Michal Schmidt) [RHEL-143686]
  - eth: ice: drop the dead code related to rss_contexts (Michal Schmidt) [RHEL-143686]
  - ice: convert to ndo_hwtstamp_get() and ndo_hwtstamp_set() (Michal Schmidt) [RHEL-143686]
  - ice: add ref-sync dpll pins (Michal Schmidt) [RHEL-143686]
  - net: ice: Perform accurate aRFS flow match (Michal Schmidt) [RHEL-143686]
  - ice: add phase offset monitor for all PPS dpll inputs (Michal Schmidt) [RHEL-143686]
  - ice: add a separate Rx handler for flow director commands (Michal Schmidt) [RHEL-143686]
  - ice: change SMA pins to SDP in PTP API (Michal Schmidt) [RHEL-143686]
  - ice: redesign dpll sma/u.fl pins control (Michal Schmidt) [RHEL-143686]
  - ice: add link_down_events statistic (Michal Schmidt) [RHEL-143686]
  - net: intel: move RSS packet classifier types to libie (Michal Schmidt) [RHEL-143686]
  - net: intel: rename 'hena' to 'hashcfg' for clarity (Michal Schmidt) [RHEL-143686]
  - ice: make const read-only array dflt_rules static (Michal Schmidt) [RHEL-143686]
  - ice: improve error message for insufficient filter space (Michal Schmidt) [RHEL-143686]
  - ice: enable LLDP TX for VFs through tc (Michal Schmidt) [RHEL-143686]
  - ice: remove headers argument from ice_tc_count_lkups (Michal Schmidt) [RHEL-143686]
  - ice: receive LLDP on trusted VFs (Michal Schmidt) [RHEL-143686]
  - ice: do not add LLDP-specific filter if not necessary (Michal Schmidt) [RHEL-143686]
  - ice: fix check for existing switch rule (Michal Schmidt) [RHEL-143686]
  - ice: clear NAPI's IRQ numbers in ice_vsi_clear_napi_queues() (Michal Schmidt) [RHEL-143686]
  - ice: refactor ICE_TC_FLWR_FIELD_ENC_OPTS (Michal Schmidt) [RHEL-143686]
  - Revert "ice: Fix ice VF reset during iavf initialization" (Michal Schmidt) [RHEL-143686]
  - ice: Fix ice VF reset during iavf initialization (Michal Schmidt) [RHEL-143686]
  - scsi: core: Fix the unit attention counter implementation (John Meneghini) [RHEL-136287]
  - scsi: st: Skip buffer flush for information ioctls (John Meneghini) [RHEL-136287]
  - scsi: st: Separate st-unique ioctl handling from SCSI common ioctl handling (John Meneghini) [RHEL-136287]
  - scsi: st: Tighten the page format heuristics with MODE SELECT (Ewan D. Milne) [RHEL-136287]
  - scsi: st: ERASE does not change tape location (Ewan D. Milne) [RHEL-136287]
  - scsi: st: Fix array overflow in st_setup() (Ewan D. Milne) [RHEL-136287] {CVE-2025-37857}
  - scsi: st: Add sysfs file position_lost_in_reset (Ewan D. Milne) [RHEL-136287]
  - scsi: st: Modify st.c to use the new scsi_error counters (Ewan D. Milne) [RHEL-136287]
  - scsi: core: Add counters for New Media and Power On/Reset UNIT ATTENTIONs (Ewan D. Milne) [RHEL-136287]
  - scsi: st: Restore some drive settings after reset (Ewan D. Milne) [RHEL-136287]
  - scsi: st: Fix input/output error on empty drive reset (Ewan D. Milne) [RHEL-136287]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.103.1.el9_6]
changelog:
  - mlxsw: spectrum_mr: Fix use-after-free when updating multicast route stats (CKI Backport Bot) [RHEL-143193] {CVE-2025-68800}


author: Niteesh Dubey <ndubey@redhat.com> - 3.21.0-1
changelog:
  - Use Kata 3.21.0
    Resolves: KATA-4199
    Resolves: KATA-4200
  - Ship CRI-O and kata configuration for peer pods
    Resolves: KATA-3969


author: Claudio Carvalho <clcarval@redhat.com> - 3.21.0-4
changelog:
  - Use pgpu kind in the CDI annotation to attach a NVIDIA GPU
    Resolves: KATA-4303
  - Add support to build initrds for kata-cc, kata-nvidia-gpu, kata-nvidia-gpu-cc
  - Add default kata policies for coco and non-coco runtime classes
    RequiredBy: KATA-3976
  - Add storage and security modules to the initrds
    Resolves: KATA-3972
  - Add crio configurations for the new runtime classes
    Resolves: KATA-3702
    Resolves: KATA-4201
  - Add pre-built initrds for x86_64
    Resolves: KATA-4202
    Resolves: KATA-3575
  - Set SELinux container_use_devices to 1 to grant access to /dev/sev


author: Daniel Kreling <dkreling@redhat.com> - 3.25.0-1
changelog:
  - Update to kata-containers 3.25.0
    Resolves: KATA-4615
  - Use udica templates from the OS to fix SELinux issues.
    Resolves: KATA-4237


author: Daniel Kreling <dkreling@redhat.com> - 3.25.0-2
changelog:
  - Fix firmware path for TDX.
  - Add support for device cold plug
  - Update sources file with initrd tarball with GPU support for CC
  - Normalize IOMMUFD device IDs in CDI coldplug
  - Set shared_fs to virtio-fs for NVIDIA GPU runtime class
  - Remove runtime_pull_image entry from the crio config file
  - Write IBM SE kernel to the /var directory
  - IBM-SE: set block_device_driver to virtio-blk
    - Resolves: KATA-4685


author: Daniel Kreling <dkreling@redhat.com> - 3.25.0-3
changelog:
  - Remove "Normalize IOMMUFD device IDs in CDI coldplug" patch
  - Rename kata-nvidia-gpu-cc to kata-cc-nvidia-gpu
    Resolves: KATA-4750
  - Add kata-addon-kernel.sh and kata-addon-kernel.service
    Resolves: KATA-4611
  - Fix multi-gpu cdi annotation handling with iommufd
  - Kata RPM version check for ibm-se


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.104.1.el9_6]
changelog:
  - KVM: arm64: Hide ID_AA64MMFR2_EL1.NV from guest and userspace (Donald Dutile) [RHEL-134766]
  - nvme/ioctl: don't warn on vectorized uring_cmd with fixed buffer (Maurizio Lombardi) [RHEL-109041]
  - nvme-ioctl: fix leaked requests on mapping error (Maurizio Lombardi) [RHEL-109041]
  - net: atm: fix /proc/net/atm/lec handling (Siva Adavi) [RHEL-146426] {CVE-2025-38180}
  - net: atm: add lec_mutex (Siva Adavi) [RHEL-146426] {CVE-2025-38180}
  - perf jitdump: Add sym/str-tables to build-ID generation (Michael Petlan) [RHEL-139921]
  - perf genelf: Fix NO_LIBDW=1 build (Michael Petlan) [RHEL-139921]
  - perf genelf: Remove libcrypto dependency and use built-in sha1() (Michael Petlan) [RHEL-139921]
  - perf util: add a basic SHA-1 implementation (Michael Petlan) [RHEL-139921]
  - driver core: fix potential NULL pointer dereference in dev_uevent() (Mark Langsdorf) [RHEL-123913]
  - driver core: introduce device_set_driver() helper (Mark Langsdorf) [RHEL-123913]
  - Revert "drivers: core: synchronize really_probe() and dev_uevent()" (Mark Langsdorf) [RHEL-123913]
  - net: bonding: update the slave array for broadcast mode (Hangbin Liu) [RHEL-132922]
  - net: bonding: add broadcast_neighbor netlink option (Hangbin Liu) [RHEL-132922]
  - net: bonding: add broadcast_neighbor option for 802.3ad (Hangbin Liu) [RHEL-132922]


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202603311951.p2.g37f810d.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/37f810d09f7e65a78bfd5d427f6348c41d59bae6


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202603290052.p2.g9d9df34.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/9d9df34c46c9deba8c291a2a084de5724c0bd820


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202604030310.p2.gdfffacd.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/dfffacdf0ad6e9aa75664c7b3167dd2ddbfc17ba


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.105.1.el9_6]
changelog:
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (Siva Adavi) [RHEL-153268] {CVE-2026-23231}
  - net: mana: Reduce waiting time if HWC not responding (Maxim Levitsky) [RHEL-151606]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.106.1.el9_6]
changelog:
  - selftests: kvm: try getting XFD and XSAVE state out of sync (CKI Backport Bot) [RHEL-141812]
  - selftests: kvm: replace numbering of sync points with actions (CKI Backport Bot) [RHEL-141812]
  - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (CKI Backport Bot) [RHEL-141812]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.107.1.el9_6]
changelog:
  - redhat: conflict with unsupported shim on x86/aarch64 (Vitaly Kuznetsov) [RHEL-162191]
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (CKI Backport Bot) [RHEL-150476] {CVE-2026-23144}
  - bonding: fix use-after-free due to enslave fail after slave array update (Arif Badar) [RHEL-152379] {CVE-2026-23171}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI KWF BOT) [RHEL-150421] {CVE-2026-23193}
  - net/sched: cls_u32: use skb_header_pointer_careful() (CKI Backport Bot) [RHEL-150402] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (CKI Backport Bot) [RHEL-150402] {CVE-2026-23204}
  - Bluetooth: MGMT: Fix memory leak in set_ssp_complete (David Marlin) [RHEL-150146]
  - Bluetooth: hci_uart: fix null-ptr-deref in hci_uart_write_work (David Marlin) [RHEL-150146]
  - Bluetooth: btusb: revert use of devm_kzalloc in btusb (David Marlin) [RHEL-150146]
  - Bluetooth: hci_uart: Fix another race during initialization (David Marlin) [RHEL-150146]
  - Bluetooth: btusb: reorder cleanup in btusb_disconnect to avoid UAF (David Marlin) [RHEL-150146]
  - Bluetooth: hci_uart: fix race during initialization (David Marlin) [RHEL-150146]
  - redhat/configs: Enable early lockdown for Arm (CKI Backport Bot) [RHEL-129495]
  - arm64: add early lockdown for secure boot (CKI Backport Bot) [RHEL-129495]
  - efi: pass secure boot mode to kernel proper (CKI Backport Bot) [RHEL-129495]
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149747] {CVE-2026-23111}


author:
  AOS Automation Release Team <noreply@redhat.com> - 4.21.11-202604201017.p0.g7f7539e.assembly.4.21.11

changelog:
  - Update to source commit https://github.com/openshift/microshift/commit/7f7539e709b3422d1ad878b80fb9d2ef4961dc71


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.108.1.el9_6]
changelog:
  - ice: fix U.FL pin state set affecting paired SMA pin (Petr Oros) [RHEL-162177]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162180]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162183]
  - rxrpc: Fix recvmsg() unconditional requeue (Arif Badar) [RHEL-147229] {CVE-2026-23066}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.109.1.el9_6]
changelog:
  - iavf: fix reset_task for early reset event (Michal Schmidt) [RHEL-160946]
  - migrate: correct lock ordering for hugetlb file folios (CKI KWF BOT) [RHEL-147265] {CVE-2026-23097}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202604171819.p2.ge27acce.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-gcp/commit/e27accef1fa99089410e4b0894db21a392d9bf99


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.110.1.el9_6]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Deepakkumar Karn) [RHEL-167015] {CVE-2026-31402}
  - crypto: iaa - Optimize rebalance_wq_table() (Jay Shin) [RHEL-137271]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.111.1.el9_6]
changelog:
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159221] {CVE-2025-68741}
  - nfsd: fix UAF when access ex_uuid or ex_stats (Olga Kornievskaia) [RHEL-141451] {CVE-2024-53216}
  - SUNRPC: no need get cache ref when protected by rcu (Olga Kornievskaia) [RHEL-141451] {CVE-2024-53216}
  - nfsd: no need get cache ref when protected by rcu (Olga Kornievskaia) [RHEL-141451] {CVE-2024-53216}
  - SUNRPC: introduce cache_check_rcu to help check in rcu context (Olga Kornievskaia) [RHEL-141451] {CVE-2024-53216}
  - RDMA/core: Fix ENODEV error for iWARP test over vlan (CKI Backport Bot) [RHEL-128545]
  - cifs: Fix deadlock in cifs_writepages during reconnect (Paulo Alcantara) [RHEL-134233]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.112.1.el9_6]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172197] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172197] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172197] {CVE-2026-31431}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170757] {CVE-2026-31532}
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171377]
  - scsi: storvsc: Process unsupported MODE_SENSE_10 (Vitaly Kuznetsov) [RHEL-171377]
  -  Add NVIDIA Jetson and Bluefield signing keys for OOT modules (Enrique Belarte Luque) [RHEL-170934]
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (CKI KWF BOT) [RHEL-166857]
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153720] {CVE-2026-23401}
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164440]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164440]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164440]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164440]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164440]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156876] {CVE-2026-23243}
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-158205]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154093]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.113.1.el9_6]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CKI Backport Bot) [RHEL-174562] {CVE-2026-43284}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202605061250.p2.gae1604b.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/ae1604b0cb7cc72e353d0b8311c6d62c34143661


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.114.1.el9_6]
changelog:
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (CKI KWF BOT) [RHEL-172925]
  - x86/kexec: Copy ACPI root pointer address from config table (Jay Shin) [RHEL-168730]


author:
  AOS Automation Release Team <noreply@redhat.com> - 4.21.16-202605180617.p0.g919341c.assembly.4.21.16

changelog:
  - Update to source commit https://github.com/openshift/microshift/commit/919341c9a08b43919eaf0c41bda1e4bf9c750cde


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.115.1.el9_6]
changelog:
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171827]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171827]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172255]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-171827]
  - Revert "ice: fix U.FL pin state set affecting paired SMA pin" (Petr Oros) [RHEL-171827]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170699]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170699]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170699]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170699]
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169632]
  - xfs: set max_agbno to allow sparse alloc of last full inode chunk (CKI Backport Bot) [RHEL-142599]
  - mm/uffd: add missing pte_mkdirty() to mfill_atomic_install_pte() (CKI Backport Bot) [RHEL-142997]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.116.1.el9_6]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176208] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176208] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176208] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176463] {CVE-2026-46333}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202605142021.p2.geab2218.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/eab2218b931d0c20740d6259df59f242abf32ef7


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.117.1.el9_6]
changelog:
  - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174334]
  - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174334]
  - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174334]
  - md/bitmap: fix GPF in write_page caused by resize race (CKI Backport Bot) [RHEL-174099] {CVE-2026-43163}
  - dpll: make the "tracker" argument optional, default NULL (Michal Schmidt) [RHEL-174822]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI KWF BOT) [RHEL-157326] {CVE-2026-23270}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (Arif Badar) [RHEL-168066] {CVE-2026-31419}
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI KWF BOT) [RHEL-150244] {CVE-2026-23210}
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (CKI Backport Bot) [RHEL-150447] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (CKI Backport Bot) [RHEL-150447] {CVE-2025-39766}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202605201414.p2.gfdf8dab.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/oc/commit/fdf8dabaedf6cf89f60547f57cc5f5f3e8d8798b


author: Daniel Kreling <dkreling@redhat.com> - 3.25.0-6
changelog:
  - Fix shim v2 crash when using `oc exec`
    Resolves: KATA-4901
  - Fix CVE-2026-41326
    Resolves: KATA-4946
  - Bump release to 3.25.0-6


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.118.1.el9_6]
changelog:
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI KWF BOT) [RHEL-171153] {CVE-2026-31685}
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-171798] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-171798] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (Abhi Das) [RHEL-171798] {CVE-2025-38653}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171428] {CVE-2026-31607}
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160457] {CVE-2026-23392}
  - nbd: defer config unlock in nbd_genl_connect (CKI KWF BOT) [RHEL-166948] {CVE-2025-68366}


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202606042250.p2.ga8c502a.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/a8c502a90d898d46e989ddeb5f00b0f1a4f02298


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202606092150.p2.gc9afac2.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/cloud-provider-azure/commit/c9afac2fda20f18d786271340826c628f5419150


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.119.1.el9_6]
changelog:
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172668] {CVE-2026-43038}
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172644] {CVE-2026-43037}
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172819] {CVE-2026-31709}
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172819] {CVE-2026-31709}
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172819] {CVE-2026-31709}
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172819] {CVE-2026-31709}
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172819] {CVE-2026-31709}
  - cifs: add validation check for the fields in smb_aces (Paulo Alcantara) [RHEL-172819]
  - cifs: fix incorrect validation for num_aces field of smb_acl (Paulo Alcantara) [RHEL-172819]
  - smb: common: change the data type of num_aces to le16 (Paulo Alcantara) [RHEL-172819]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.120.1.el9_6]
changelog:
  - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170537] {CVE-2026-31508}
  - selftests: net: check jq command is supported (Guillaume Nault) [RHEL-169934]
  - selftests: rtnetlink: Fix do_test_address_proto() (Guillaume Nault) [RHEL-169934]
  - selftests: rtnetlink: Add an address proto test (Guillaume Nault) [RHEL-169934]
  - net: ipv4: Allow changing IPv4 address protocol (Guillaume Nault) [RHEL-169934]
  - net: Add new protocol attribute to IP addresses (Guillaume Nault) [RHEL-169934]
  - sctp: discard stale INIT after handshake completion (Arif Badar) [RHEL-178272]
  - netfilter: skip recording stale or retransmitted INIT (Arif Badar) [RHEL-178272]
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173856] {CVE-2026-43110}
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174220] {CVE-2026-43190}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165562] {CVE-2026-23216}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-143878] {CVE-2026-22990}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-142097] {CVE-2025-71116}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI KWF BOT) [RHEL-166985] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166925] {CVE-2025-68724}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-148783] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-148783] {CVE-2025-71089}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-143896] {CVE-2026-22984}
  - net: use dst_dev_rcu() in sk_setup_caps() (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083] {CVE-2025-40170}
  - ipv6: use RCU in ip6_xmit() (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083] {CVE-2025-40135}
  - ipv6: use RCU in ip6_output() (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083] {CVE-2025-40158}
  - net: dst: introduce dst->dev_rcu (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083]
  - net: dst: add four helpers to annotate data-races around dst->dev (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083]
  - ipv4: use RCU protection in __ip_rt_update_pmtu() (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083]
  - ipv4: use RCU protection in ip_dst_mtu_maybe_forward() (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083]
  - net: ipv4: Consolidate ipv4_mtu and ip_dst_mtu_maybe_forward (Hangbin Liu) [RHEL-128978 RHEL-129015 RHEL-129083]
  - ipv4: add RCU protection to ip4_dst_hoplimit() (Guillaume Nault) [RHEL-128978 RHEL-129015 RHEL-129083]
  - book3s64/hash: Remove kfence support temporarily (CKI Backport Bot) [RHEL-135573]
  - mm/debug_vm_pgtable: clear page table entries at destroy_args() (CKI Backport Bot) [RHEL-128733]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.121.1.el9_6]
changelog:
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179668] {CVE-2026-45898}
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-168926]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-168926]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-168926]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-168926]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-168926]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-168926]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-168926]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-168926]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-168926]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-168926]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-168926]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-168926]
  - lib/scatterlist: Add SG_MITER_LOCAL and use it (Ilya Dryomov) [RHEL-168926]
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174042] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174042] {CVE-2026-43158}
  - ice: fix stats array overflow when VF requests more queues (CKI Backport Bot) [RHEL-177524]
  - netfilter: ctnetlink: ensure safe access to master conntrack (Arif Badar) [RHEL-173881] {CVE-2026-43116}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.122.1.el9_6]
changelog:
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183129]
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180021] {CVE-2026-46166}
  - net: gro: don't merge zcopy skbs (CKI Backport Bot) [RHEL-177873] {CVE-2026-46323}
  - smc: Use __sk_dst_get() and dst_dev_rcu() in smc_clc_prfx_match(). (Mete Durlu) [RHEL-130016] {CVE-2025-40168}
  - smc: Fix use-after-free in __pnet_find_base_ndev(). (Mete Durlu) [RHEL-126891] {CVE-2025-40064}
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178942] {CVE-2026-46243}
  - wifi: mac80211: remove station if connection prep fails (Arif Badar) [RHEL-180119] {CVE-2026-46125}
  - wifi: mac80211: verify state before connection (Arif Badar) [RHEL-180119]
  - mm/page_alloc: clear page->private in free_pages_prepare() (CKI KWF BOT) [RHEL-174748] {CVE-2026-43303}
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-161145]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-161145] {CVE-2024-57883}
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-161145]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-161145] {CVE-2026-23100}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-161145]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-161145]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-161145] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-161145]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-161145] {CVE-2025-39844}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175439]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-150463] {CVE-2026-23136}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.123.1.el9_6]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Arif Badar) [RHEL-177388] {CVE-2026-46331}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.124.1.el9_6]
changelog:
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI KWF BOT) [RHEL-179995] {CVE-2026-46176}
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (CKI KWF BOT) [RHEL-179977] {CVE-2026-46181}
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171504] {CVE-2026-31669}
  - s390/mm: Add missing secure storage access fixups for donated memory (Mete Durlu) [RHEL-183316]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (CKI Backport Bot) [RHEL-178407] {CVE-2026-43501}
  - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-174000] {CVE-2026-43125}
  - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-174000] {CVE-2026-43125}
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI KWF BOT) [RHEL-181945] {CVE-2026-46244}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180007] {CVE-2026-46173}
  - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179710] {CVE-2026-45852}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179866] {CVE-2026-46227}
  - netfilter: flowtable: strictly check for maximum number of actions (Arif Badar) [RHEL-176916] {CVE-2026-43329}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174028] {CVE-2026-43128}
  - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (CKI Backport Bot) [RHEL-174469]
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172991]
  - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172991]
  - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172991]
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172991]
  - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172991]
  - iavf: allow changing VLAN state without calling PF (Michal Schmidt) [RHEL-172991]
  - ALSA: aloop: Fix racy access at PCM trigger (CKI KWF BOT) [RHEL-150129] {CVE-2026-23191}
  - netfilter: conntrack: clamp maximum hashtable size to INT_MAX (CKI KWF BOT) [RHEL-141469] {CVE-2025-21648}
  - cachestat: fix page cache statistics permission checking (CKI KWF BOT) [RHEL-141470] {CVE-2025-21691}


author: Daniel Kreling <dkreling@redhat.com> - 3.25.0-1
changelog:
  - Update to kata-containers 3.25.0
    Resolves: KATA-4633
  - Use pgpu kind in the CDI annotation to attach a NVIDIA GPU
    Resolves: KATA-4303
  - Add support to build initrds for kata-cc, kata-nvidia-gpu, kata-nvidia-gpu-cc
  - Add default kata policies for coco and non-coco runtime classes
    RequiredBy: KATA-3976
  - Add storage and security modules to the initrds
    Resolves: KATA-3972
  - Add crio configurations for the new runtime classes
    Resolves: KATA-3702
    Resolves: KATA-4201
  - Add pre-built initrds for x86_64
    Resolves: KATA-4202
    Resolves: KATA-3575
  - Set SELinux container_use_devices to 1 to grant access to /dev/sev


author: Jens Freimann <jfreiman@redhat.com> - 3.31.0-3
changelog:
  - Fix kata-nvidia-gpu firmware path: clear firmware= so QEMU uses its
    built-in default instead of /usr/share/OVMF.fd which does not exist
    on RHEL9
  - Fix pcie_root_port=0 in CC GPU configs.
    Resolves: KATA-5471


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.125.1.el9_6]
changelog:
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179751] {CVE-2026-43414}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (Arif Badar) [RHEL-179314] {CVE-2026-46090}
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174238] {CVE-2026-43198}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI KWF BOT) [RHEL-172618] {CVE-2026-43027}
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (CKI KWF BOT) [RHEL-150177]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.126.1.el9_6]
changelog:
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179959] {CVE-2026-46189}
  - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182539]
  - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182539]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182539]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182539]
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180052] {CVE-2026-46152}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173933] {CVE-2026-43279}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (CKI KWF BOT) [RHEL-180097] {CVE-2026-46135}
  - gfs2: Fix use-after-free in iomap inline data write path (CKI KWF BOT) [RHEL-179591] {CVE-2026-45984}
  - gfs2: Add metapath_dibh helper (CKI KWF BOT) [RHEL-179591] {CVE-2026-45984}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-166890] {CVE-2025-68183}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (Arif Badar) [RHEL-165061] {CVE-2026-31408}
  - mm, xfs: suppress __GFP_NOFAIL|PF_MEMALLOC warning for XFS buffer allocation (Nico Pache) [RHEL-164774]
  - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (CKI KWF BOT) [RHEL-164774]
  - mm/page_alloc: simplify __alloc_pages_slowpath() flow (CKI KWF BOT) [RHEL-164774]
  - mm/page_alloc: refactor the initial compaction handling (CKI KWF BOT) [RHEL-164774]
  - mm/page_alloc: ignore the exact initial compaction result (CKI KWF BOT) [RHEL-164774]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (CKI KWF BOT) [RHEL-164774]
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (CKI KWF BOT) [RHEL-164774]
  - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (CKI KWF BOT) [RHEL-164774]
  - mm: document __GFP_NOFAIL must be blockable (CKI KWF BOT) [RHEL-164774]


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202607071622.p2.g72d01d1.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/72d01d1a9470f51f856b9b4b04e058e7645e4fb4


author: AOS Automation Release Team <noreply@redhat.com> - 4.21.0-202607090251.p2.gba6535c.assembly.stream
changelog:
  - Update to source commit https://github.com/openshift/kubernetes/commit/ba6535cbb8719c3ba6c3923f2725ba050c87faab


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.127.1.el9_6]
changelog:
  - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183967] {CVE-2026-46316}
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180772]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180772]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180772]
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180772]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180772]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180772]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180772] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180772]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180772]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180772]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180772]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180772]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180772]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173828] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180772]
  - file: add fput() cleanup helper (Waiman Long) [RHEL-180772]
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (CKI Backport Bot) [RHEL-192417] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-192417] {CVE-2026-46113 CVE-2026-53359}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.128.1.el9_6]
changelog:
  - xfs: resample the data fork mapping after cycling ILOCK (Jan Stancek) [RHEL-193942]
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193244] {CVE-2026-53166}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193244] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193154] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193154] {CVE-2026-43499}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-570.129.1.el9_6]
changelog:
  - Bluetooth: hci_event: Fix UAF in hci_acl_create_conn_sync (CKI Backport Bot) [RHEL-123817] {CVE-2025-39982}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179906] {CVE-2026-46209}
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (CKI Backport Bot) [RHEL-180179] {CVE-2026-46116}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178833] {CVE-2026-31488}
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171743]
  - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171743]
  - smb: client: fix OOB reads parsing symlink error response (Piyush Thange) [RHEL-171469] {CVE-2026-31613}
  - net: sched: act_csum: validate nested VLAN headers (Arif Badar) [RHEL-171136] {CVE-2026-31684}
  - vt: prevent kernel-infoleak in con_font_get() (Aristeu Rozanski) [RHEL-65129] {CVE-2024-50076}
  - VMCI: Fix use-after-free when removing resource in vmci_resource_remove() (Aristeu Rozanski) [RHEL-59279] {CVE-2024-46738}
  - s390/pci: Fix __pcilg_mio_inuser() inline assembly (Mete Durlu) [RHEL-161490]
  - printk: Use console_is_usable on console_unblank (CKI Backport Bot) [RHEL-148301]
  - printk: Check CON_SUSPEND when unblanking a console (CKI Backport Bot) [RHEL-148301]
  - printk: Avoid irq_work for printk_deferred() on suspend (CKI Backport Bot) [RHEL-148301]
  - printk: Avoid scheduling irq_work on suspend (CKI Backport Bot) [RHEL-148301]
  - printk: nbcon: Allow reacquire during panic (CKI Backport Bot) [RHEL-148301]
  - printk: Allow printk_trigger_flush() to flush all types (CKI Backport Bot) [RHEL-148301]
  - printk: nbcon: Use raw_cpu_ptr() instead of open coding (CKI Backport Bot) [RHEL-148301]
  - backport "printk: Add helper for flush type logic" and associated changes (CKI Backport Bot) [RHEL-148301]
  - printk: Remove redundant deferred check in vprintk() (CKI Backport Bot) [RHEL-148301]
  - printk: Introduce force_legacy_kthread() macro (CKI Backport Bot) [RHEL-148301]
  - printk: Add is_printk_legacy_deferred() (CKI Backport Bot) [RHEL-148301]
  - smb: client: Add tracepoint for krb5 auth (Paulo Alcantara) [RHEL-145508]
  - smb: client: improve error message when creating SMB session (Paulo Alcantara) [RHEL-145508]
  - smb: client: relax session and tcon reconnect attempts (Paulo Alcantara) [RHEL-145508]
  - cifs: #include cifsglob.h before trace.h to allow structs in tracepoints (Paulo Alcantara) [RHEL-145508]


