diff --git a/COPYING-5.14.0-687.31.1.el9 b/COPYING-5.14.0-687.34.1.el9 similarity index 100% rename from COPYING-5.14.0-687.31.1.el9 rename to COPYING-5.14.0-687.34.1.el9 diff --git a/Makefile.rhelver b/Makefile.rhelver index 0251b016a0..a3dec62c1f 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 8 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 687.31.1 +RHEL_RELEASE = 687.34.1 # # ZSTREAM diff --git a/arch/s390/mm/fault.c b/arch/s390/mm/fault.c index 1fb58159c7..6b1305f292 100644 --- a/arch/s390/mm/fault.c +++ b/arch/s390/mm/fault.c @@ -544,11 +544,11 @@ void do_secure_storage_access(struct pt_regs *regs) mmap_read_unlock(mm); break; case KERNEL_FAULT: - page = phys_to_page(addr); + page = virt_to_head_page((void *)addr); if (unlikely(!try_get_page(page))) break; - rc = uv_convert_from_secure(addr); + rc = uv_convert_from_secure(page_to_phys(page)); if (!rc) clear_bit(PG_arch_1, &page->flags); put_page(page); diff --git a/drivers/net/wwan/t7xx/t7xx_pci.c b/drivers/net/wwan/t7xx/t7xx_pci.c index e556e5bd49..03f752cab2 100644 --- a/drivers/net/wwan/t7xx/t7xx_pci.c +++ b/drivers/net/wwan/t7xx/t7xx_pci.c @@ -400,6 +400,9 @@ static int __t7xx_pci_pm_suspend(struct pci_dev *pdev) goto abort_suspend; } + /* Delay to prevent SAP suspend timeout */ + msleep(50); + ret = t7xx_send_pm_request(t7xx_dev, H2D_CH_SUSPEND_REQ_AP); if (ret) { t7xx_send_pm_request(t7xx_dev, H2D_CH_RESUME_REQ); diff --git a/fs/gfs2/bmap.c b/fs/gfs2/bmap.c index 05f348c3b6..c96f25ef31 100644 --- a/fs/gfs2/bmap.c +++ b/fs/gfs2/bmap.c @@ -1313,6 +1313,19 @@ static int gfs2_block_zero_range(struct inode *inode, loff_t from, return iomap_zero_range(inode, from, length, NULL, &gfs2_iomap_ops); } +int gfs2_clear_beyond_eof(struct inode *inode, loff_t end) +{ + loff_t isize = i_size_read(inode); + unsigned int len = isize & ~PAGE_MASK; + + if (!len || isize >= end) + return 0; + len = PAGE_SIZE - len; + if (end - isize < len) + len = end - isize; + return gfs2_block_zero_range(inode, isize, len); +} + #define GFS2_JTRUNC_REVOKES 8192 /** @@ -2097,6 +2110,12 @@ static int do_grow(struct inode *inode, u64 size) unstuff = 1; } + if (!unstuff) { + error = gfs2_clear_beyond_eof(inode, size); + if (error) + goto do_grow_qunlock; + } + error = gfs2_trans_begin(sdp, RES_DINODE + RES_STATFS + RES_RG_BIT + (unstuff && gfs2_is_jdata(ip) ? RES_JDATA : 0) + diff --git a/fs/gfs2/bmap.h b/fs/gfs2/bmap.h index 9ce43c0c95..62b128bdd8 100644 --- a/fs/gfs2/bmap.h +++ b/fs/gfs2/bmap.h @@ -57,6 +57,7 @@ int gfs2_get_extent(struct inode *inode, u64 lblock, u64 *dblock, unsigned int *extlen); int gfs2_alloc_extent(struct inode *inode, u64 lblock, u64 *dblock, unsigned *extlen, bool *new); +int gfs2_clear_beyond_eof(struct inode *inode, loff_t end); int gfs2_setattr_size(struct inode *inode, u64 size); void gfs2_trim_blocks(struct inode *inode); int gfs2_truncatei_resume(struct gfs2_inode *ip); diff --git a/fs/gfs2/file.c b/fs/gfs2/file.c index a8c9c50aac..4dbec06dcb 100644 --- a/fs/gfs2/file.c +++ b/fs/gfs2/file.c @@ -1038,6 +1038,10 @@ retry: goto out_unlock; } + ret = gfs2_clear_beyond_eof(inode, iocb->ki_pos); + if (ret) + goto out_unlock; + pagefault_disable(); ret = iomap_file_buffered_write(iocb, from, &gfs2_iomap_ops); pagefault_enable(); @@ -1240,6 +1244,12 @@ static long __gfs2_fallocate(struct file *file, int mode, loff_t offset, loff_t next = (next + 1) << sdp->sd_sb.sb_bsize_shift; + if (!(mode & FALLOC_FL_KEEP_SIZE)) { + error = gfs2_clear_beyond_eof(inode, offset + len); + if (error) + return error; + } + offset &= bsize_mask; len = next - offset; diff --git a/ipc/util.c b/ipc/util.c index 05cb9de667..14dec7e9c8 100644 --- a/ipc/util.c +++ b/ipc/util.c @@ -253,7 +253,7 @@ static inline int ipc_idr_alloc(struct ipc_ids *ids, struct kern_ipc_perm *new) } else { new->seq = ipcid_to_seqx(next_id); idx = idr_alloc(&ids->ipcs_idr, new, ipcid_to_idx(next_id), - 0, GFP_NOWAIT); + ipc_mni, GFP_NOWAIT); } if (idx >= 0) new->id = (new->seq << ipcmni_seq_shift()) + idx; diff --git a/kernel.sbat b/kernel.sbat index b54e7dd0c8..394fc6ec8a 100644 --- a/kernel.sbat +++ b/kernel.sbat @@ -1,3 +1,3 @@ sbat,1,SBAT Version,sbat,1,https://github.com/rhboot/shim/blob/main/SBAT.md -kernel.rhel,1,Red Hat,kernel-core,5.14.0-687.31.1.el9.x86_64,mailto:secalert@redhat.com -kernel.almalinux,1,AlmaLinux,kernel-core,5.14.0-687.31.1.el9.x86_64,mailto:security@almalinux.org +kernel.rhel,1,Red Hat,kernel-core,5.14.0-687.34.1.el9.x86_64,mailto:secalert@redhat.com +kernel.almalinux,1,AlmaLinux,kernel-core,5.14.0-687.34.1.el9.x86_64,mailto:security@almalinux.org diff --git a/kernel/time/timer.c b/kernel/time/timer.c index 4ebe41695e..dafb32ed1c 100644 --- a/kernel/time/timer.c +++ b/kernel/time/timer.c @@ -1360,10 +1360,11 @@ static int __try_to_del_timer_sync(struct timer_list *timer, bool shutdown) base = lock_timer_base(timer, &flags); - if (base->running_timer != timer) + if (base->running_timer != timer) { ret = detach_if_pending(timer, base, true); - if (shutdown) - timer->function = NULL; + if (shutdown) + timer->function = NULL; + } raw_spin_unlock_irqrestore(&base->lock, flags); diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c index 0d76e69171..4fb8a6f40e 100644 --- a/net/sched/cls_api.c +++ b/net/sched/cls_api.c @@ -4049,6 +4049,9 @@ struct sk_buff *tcf_qevent_handle(struct tcf_qevent *qe, struct Qdisc *sch, stru skb_do_redirect(skb); *ret = __NET_XMIT_STOLEN; return NULL; + case TC_ACT_CONSUMED: + *ret = __NET_XMIT_STOLEN; + return NULL; } return skb; diff --git a/net/tipc/msg.c b/net/tipc/msg.c index 76284fc538..b0bba0feef 100644 --- a/net/tipc/msg.c +++ b/net/tipc/msg.c @@ -177,8 +177,20 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf) if (fragid == LAST_FRAGMENT) { TIPC_SKB_CB(head)->validated = 0; - if (unlikely(!tipc_msg_validate(&head))) + + /* If the reassembled skb has been freed in + * tipc_msg_validate() because of an invalid truesize, + * then head will point to a newly allocated reassembled + * skb, while *headbuf points to freed reassembled skb. + * In such cases, correct *headbuf for freeing the newly + * allocated reassembled skb later. + */ + if (unlikely(!tipc_msg_validate(&head))) { + if (head != *headbuf) + *headbuf = head; goto err; + } + *buf = head; TIPC_SKB_CB(head)->tail = NULL; *headbuf = NULL; diff --git a/redhat/kernel.changelog-9.8 b/redhat/kernel.changelog-9.8 index cfba9185a3..a389237550 100644 --- a/redhat/kernel.changelog-9.8 +++ b/redhat/kernel.changelog-9.8 @@ -1,3 +1,20 @@ +* Mon Aug 03 2026 CKI KWF Bot [5.14.0-687.34.1.el9_8] +- s390/mm: Ensure physical addr derived from page is passed in to uv_convert_from_secure() (Lucas Oakley) [RHEL-192430] +- s390/mm: Fix phys_to_folio() usage in do_secure_storage_access() (Charles Haithcock) [RHEL-216471] +- gfs2: page poisoning fix (CKI Backport Bot) [RHEL-214021] +- timers: Fix NULL function pointer race in timer_shutdown_sync() (CKI Backport Bot) [RHEL-189940] {CVE-2025-68214} +- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184273] +Resolves: RHEL-184273, RHEL-189940, RHEL-192430, RHEL-214021, RHEL-216471 + +* Wed Jul 29 2026 CKI KWF Bot [5.14.0-687.33.1.el9_8] +- net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213299] {CVE-2026-64530} +- ipc: limit next_id allocation to the valid ID range (Rafael Aquini) [RHEL-188214] {CVE-2026-52923} +Resolves: RHEL-188214, RHEL-213299 + +* Tue Jul 28 2026 CKI KWF Bot [5.14.0-687.32.1.el9_8] +- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192184] {CVE-2026-52993} +Resolves: RHEL-192184 + * Mon Jul 27 2026 CKI KWF Bot [5.14.0-687.31.1.el9_8] - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213163] {CVE-2026-64017}