diff --git a/.gitignore b/.gitignore index c0b577bfc..8fd577f98 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ -SOURCES/kernel-abi-stablelists-5.14.0-687.29.1.el9_8.tar.bz2 -SOURCES/kernel-kabi-dw-5.14.0-687.29.1.el9_8.tar.bz2 -SOURCES/linux-5.14.0-687.29.1.el9_8.tar.xz +SOURCES/kernel-abi-stablelists-5.14.0-687.30.1.el9_8.tar.bz2 +SOURCES/kernel-kabi-dw-5.14.0-687.30.1.el9_8.tar.bz2 +SOURCES/linux-5.14.0-687.30.1.el9_8.tar.xz SOURCES/nvidiabfdpu.x509 SOURCES/nvidiagpuoot001.x509 SOURCES/nvidiajetsonsoc.x509 diff --git a/.kernel.metadata b/.kernel.metadata index 3927839a3..013f54560 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,6 +1,6 @@ -cd32df0727c6c8efeafb2e17b8edab4378891a02 SOURCES/kernel-abi-stablelists-5.14.0-687.29.1.el9_8.tar.bz2 -3219167f81d484c7099eb75b5067e6b2d2707a14 SOURCES/kernel-kabi-dw-5.14.0-687.29.1.el9_8.tar.bz2 -da61672c23167ede24be0cd8207685b1a1185d81 SOURCES/linux-5.14.0-687.29.1.el9_8.tar.xz +a2203d012022d3a3fabc30371a4c226478311e5c SOURCES/kernel-abi-stablelists-5.14.0-687.30.1.el9_8.tar.bz2 +b124dec682f398acd734edef44f45b4468ca3816 SOURCES/kernel-kabi-dw-5.14.0-687.30.1.el9_8.tar.bz2 +ee8c2b0677d3bd5e11933b08ee4f9b335ff6bf43 SOURCES/linux-5.14.0-687.30.1.el9_8.tar.xz 3dc4997e0273ca116d52a52238a57403aba5dafb SOURCES/nvidiabfdpu.x509 4fff8080e88afffc06d8ef5004db8d53bb21237f SOURCES/nvidiagpuoot001.x509 18378ab150ef13ef65609224e10a2e8501d82915 SOURCES/nvidiajetsonsoc.x509 diff --git a/SOURCES/Makefile.rhelver b/SOURCES/Makefile.rhelver index e1b5c4270..3a700f794 100644 --- a/SOURCES/Makefile.rhelver +++ b/SOURCES/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 8 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 687.29.1 +RHEL_RELEASE = 687.30.1 # # ZSTREAM diff --git a/SOURCES/kernel.changelog b/SOURCES/kernel.changelog index b32c8d692..bbd565309 100644 --- a/SOURCES/kernel.changelog +++ b/SOURCES/kernel.changelog @@ -1,3 +1,20 @@ +* Wed Jul 22 2026 CKI KWF Bot [5.14.0-687.30.1.el9_8] +- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} +- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] +- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] +- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] +- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] +- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} +- scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] +- drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} +- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} +- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} +Resolves: RHEL-187412, RHEL-188541, RHEL-188647, RHEL-192220, RHEL-192228, RHEL-211277, RHEL-213468 + * Tue Jul 21 2026 CKI KWF Bot [5.14.0-687.29.1.el9_8] - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061] diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 48081969f..33ea1b14f 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -176,15 +176,15 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 687.29.1 +%define pkgrelease 687.30.1 %define kversion 5 -%define tarfile_release 5.14.0-687.29.1.el9_8 +%define tarfile_release 5.14.0-687.30.1.el9_8 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 687.29.1%{?buildid}%{?dist} +%define specrelease 687.30.1%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-687.29.1.el9_8 +%define kabiversion 5.14.0-687.30.1.el9_8 # # End of genspec.sh variables @@ -3795,7 +3795,7 @@ fi # # %changelog -* Thu Jul 23 2026 Andrew Lukoshko - 5.14.0-687.29.1 +* Fri Jul 31 2026 Andrew Lukoshko - 5.14.0-687.30.1 - proc: fix a dentry lock race between release_task and lookup - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024 - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024 @@ -3807,12 +3807,28 @@ fi - kernel/rh_messages.h: enable all disabled pci devices by moving to unmaintained -* Thu Jul 23 2026 Eduard Abdullin - 5.14.0-687.29.1 +* Fri Jul 31 2026 Eduard Abdullin - 5.14.0-687.30.1 - Use AlmaLinux OS secure boot cert - Debrand for AlmaLinux OS - Add KVM support for ppc64le - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds +* Wed Jul 22 2026 CKI KWF Bot [5.14.0-687.30.1.el9_8] +- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213468] {CVE-2026-63807} +- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213468] +- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213468] +- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213468] +- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Paolo Bonzini) [RHEL-211277] +- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211277] {CVE-2025-40026} +- scsi: core: Run queues for all non-SDEV_DEL devices from scsi_run_host_queues (David Jeffery) [RHEL-187412] +- drm/xe/dma-buf: fix UAF with retry loop (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe/dma-buf: handle empty bo and UAF races (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe: Fix bo leak in xe_dma_buf_init_obj() on allocation failure (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- drm/xe: Fix dma-buf attachment leak in xe_gem_prime_import() (Anusha Srivatsa) [RHEL-192228] {CVE-2026-52950} +- ipv6: fix possible UAF in icmpv6_rcv() (CKI Backport Bot) [RHEL-192220] {CVE-2026-53006} +- drm/xe: Fix error cleanup in xe_exec_queue_create_ioctl() (CKI Backport Bot) [RHEL-188647] {CVE-2026-52976} +- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188541] {CVE-2026-53059} + * Tue Jul 21 2026 CKI KWF Bot [5.14.0-687.29.1.el9_8] - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685] - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]