diff --git a/.gitignore b/.gitignore index 5f83688..6022c99 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ SOURCES/centossecureboot201.cer SOURCES/centossecurebootca2.cer -SOURCES/linux-4.18.0-553.141.1.rt7.482.el8_10.tar.xz +SOURCES/linux-4.18.0-553.143.1.rt7.484.el8_10.tar.xz SOURCES/redhatsecureboot302.cer SOURCES/redhatsecureboot303.cer SOURCES/redhatsecureboot501.cer diff --git a/.kernel-rt.metadata b/.kernel-rt.metadata index ef1f3b5..ffaac96 100644 --- a/.kernel-rt.metadata +++ b/.kernel-rt.metadata @@ -1,6 +1,6 @@ 2ba40bf9138b48311e5aa1b737b7f0a8ad66066f SOURCES/centossecureboot201.cer bfdb3d7cffc43f579655af5155d50c08671d95e5 SOURCES/centossecurebootca2.cer -e32e3a7919ed43f03cc8ff81152930f46df05108 SOURCES/linux-4.18.0-553.141.1.rt7.482.el8_10.tar.xz +57e986ba435d1ae6b1dc46f66c0727f9ed0dfbef SOURCES/linux-4.18.0-553.143.1.rt7.484.el8_10.tar.xz 13e5cd3f856b472fde80a4deb75f4c18dfb5b255 SOURCES/redhatsecureboot302.cer e89890ca0ded2f9058651cc5fa838b78db2e6cc2 SOURCES/redhatsecureboot303.cer ba0b760e594ff668ee72ae348adf3e49b97f75fb SOURCES/redhatsecureboot501.cer diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 671ca3e..4ae5dcd 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -49,10 +49,10 @@ # define buildid .local %define specversion 4.18.0 -%define pkgrelease 553.141.1.rt7.482.el8_10 +%define pkgrelease 553.143.1.rt7.484.el8_10 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 553.141.1.rt7.482%{?dist} +%define specrelease 553.143.1.rt7.484%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -159,7 +159,7 @@ # The preempt RT patch level %global rttag .rt7 # realtimeN -%global rtbuild .482 +%global rtbuild .484 %define with_doc 0 %define with_headers 0 %define with_cross_headers 0 @@ -2726,6 +2726,27 @@ fi # # %changelog +* Thu Jul 09 2026 CKI KWF Bot [4.18.0-553.143.1.rt7.484.el8_10] +- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193334] {CVE-2026-53166} +- rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193143] {CVE-2026-43499} + +* Thu Jul 09 2026 CKI KWF Bot [4.18.0-553.142.1.rt7.483.el8_10] +- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192411] {CVE-2026-53359} +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186618] {CVE-2026-46113} +- KVM: x86/mmu: pull call to drop_large_spte() into __link_shadow_page() (Paolo Bonzini) [RHEL-186618] +- KVM: x86/mmu: Always pass 0 for @quadrant when gptes are 8 bytes (Aidan Wallace) [RHEL-186618] +- KVM: x86/mmu: Derive shadow MMU page role from parent (Aidan Wallace) [RHEL-186618] +- KVM: x86/mmu: Stop passing "direct" to mmu_alloc_root() (Aidan Wallace) [RHEL-186618] +- KVM: x86/mmu: Use a bool for direct (Aidan Wallace) [RHEL-186618] +- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182341] +- net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-182996] {CVE-2025-71066} +- iommu/vt-d: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} +- iommu/amd: track SVA mm for kernel page table flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} +- x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} +- iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} +- iommu/vt-d: Fix incorrect cache invalidation for mm notification (Jerry Snitselaar) [RHEL-150534] {CVE-2025-71089} +- net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167045] {CVE-2026-31411} + * Mon Jul 06 2026 CKI KWF Bot [4.18.0-553.141.1.rt7.482.el8_10] - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189506] {CVE-2026-43112}