From 1f229fd69aece768c0730d0b94be579bb3807d01 Mon Sep 17 00:00:00 2001 From: AlmaLinux RelEng Bot Date: Thu, 10 Sep 2026 02:56:48 -0400 Subject: [PATCH] import CS git kernel-4.18.0-553.162.1.el8_10 --- .gitignore | 2 +- .kernel.metadata | 6 +++--- SPECS/kernel.spec | 38 ++++++++++++++++++++++++++++++++++++-- 3 files changed, 40 insertions(+), 6 deletions(-) diff --git a/.gitignore b/.gitignore index 9530e2119..365ed65c5 100644 --- a/.gitignore +++ b/.gitignore @@ -2,7 +2,7 @@ SOURCES/centossecureboot201.cer SOURCES/centossecurebootca2.cer SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 -SOURCES/linux-4.18.0-553.160.1.el8_10.tar.xz +SOURCES/linux-4.18.0-553.162.1.el8_10.tar.xz SOURCES/redhatsecureboot302.cer SOURCES/redhatsecureboot303.cer SOURCES/redhatsecureboot501.cer diff --git a/.kernel.metadata b/.kernel.metadata index 239b94916..9421cb52f 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,8 +1,8 @@ 2ba40bf9138b48311e5aa1b737b7f0a8ad66066f SOURCES/centossecureboot201.cer bfdb3d7cffc43f579655af5155d50c08671d95e5 SOURCES/centossecurebootca2.cer -0836849d25156e13ed3cd143ccef30b9a6d9b0f7 SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 -48ce99250c6179a1a97f4881baa839bb1916e05c SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 -9a81c9e6f2678b56fdefab7ad9967ff93c659175 SOURCES/linux-4.18.0-553.160.1.el8_10.tar.xz +87705a9cbebbc87097b636c45adc8a89e9214de6 SOURCES/kernel-abi-stablelists-4.18.0-553.tar.bz2 +aa742d439b76d47bf06ec74d9e9a0d52cd027051 SOURCES/kernel-kabi-dw-4.18.0-553.tar.bz2 +de6c8c314ee79ce76f6cd9420fc99bb3242813ec SOURCES/linux-4.18.0-553.162.1.el8_10.tar.xz 13e5cd3f856b472fde80a4deb75f4c18dfb5b255 SOURCES/redhatsecureboot302.cer e89890ca0ded2f9058651cc5fa838b78db2e6cc2 SOURCES/redhatsecureboot303.cer ba0b760e594ff668ee72ae348adf3e49b97f75fb SOURCES/redhatsecureboot501.cer diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index 6aab07add..37eda1b77 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -49,10 +49,10 @@ # define buildid .local %define specversion 4.18.0 -%define pkgrelease 553.160.1.el8_10 +%define pkgrelease 553.162.1.el8_10 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 553.160.1%{?dist} +%define specrelease 553.162.1%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -2797,6 +2797,40 @@ fi # # %changelog +* Wed Sep 09 2026 CKI KWF Bot [4.18.0-553.162.1.el8_10] +- scsi: mpt3sas: Avoid freeing unallocated PCIe SGL buffers (Laurence Oberman) [RHEL-194117] +- tipc: fix slab-use-after-free Read in tipc_aead_decrypt_done (Xin Long) [RHEL-228877] {CVE-2026-63801} +- tipc: clear sock->sk on the failed-insert path in tipc_sk_create() (Xin Long) [RHEL-238050] {CVE-2026-68117} +- sctp: fix race between sctp_wait_for_connect and peeloff (Xin Long) [RHEL-229464] {CVE-2026-63971} +- sctp: diag: reject stale associations in dump_one path (Xin Long) [RHEL-231561] {CVE-2026-52917} +- sctp: validate stream count in sctp_process_strreset_inreq() (Xin Long) [RHEL-236135] {CVE-2026-68315} +- sctp: fix auth_hmacs array size in struct sctp_cookie (Xin Long) [RHEL-237394] {CVE-2026-68376} +- sctp: auth: verify auth requirement when auth_chunk is NULL (Xin Long) [RHEL-237088] {CVE-2026-68300} +- gfs2: harden gfs2_glock_hold (Andreas Gruenbacher) [RHEL-240340] +- gfs2: gfs2_glock_hold cleanup (Andreas Gruenbacher) [RHEL-240340] +- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190202] +- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190202] {CVE-2026-53246} +- netfilter: nf_log: validate MAC header was set before dumping it (CKI Backport Bot) [RHEL-232055] {CVE-2026-52942} +- netfilter: nf_conntrack_sip: don't use simple_strtoul (CKI Backport Bot) [RHEL-232024] {CVE-2026-52986} +- scsi: qla2xxx: Clear cmds after chip reset (CKI Backport Bot) [RHEL-230822] {CVE-2025-68745} +- scsi: target: configfs: Bound snprintf() return in tg_pt_gp_members_show() (CKI Backport Bot) [RHEL-225791] {CVE-2026-46149} + +* Mon Sep 07 2026 CKI KWF Bot [4.18.0-553.161.1.el8_10] +- security/keys: fix missed RCU read section on lookup (Bruno Meneguele) [RHEL-225679] {CVE-2026-64015} +- ixgbevf: fix use-after-free in VEPA multicast source pruning (CKI Backport Bot) [RHEL-227760] {CVE-2026-64113} +- xfrm: Don't clobber inner headers when already set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: pull headers in qdisc_pkt_len_segs_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: qdisc_pkt_len_segs_init() cleanup (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: use qdisc_pkt_len_segs_init() in sch_handle_ingress() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net_sched: initialize qdisc_skb_cb(skb)->pkt_segs in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: init shinfo->gso_segs from qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: add more sanity checks to qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net_sched: make room for (struct qdisc_skb_cb)->pkt_segs (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: account for encap headers in qdisc pkt len (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- sch_cake: do not use skb_mac_header() in cake_overhead() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: do not use skb_mac_header() in qdisc_pkt_len_init() (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} +- net: Skip GSO length estimation if transport header is not set (Ivan Vecera) [RHEL-188227] {CVE-2026-53091} + * Thu Sep 03 2026 CKI KWF Bot [4.18.0-553.160.1.el8_10] - rhashtable: clear stale iter->p on table restart (CKI Backport Bot) [RHEL-248433] {CVE-2026-64563} - net: bridge: stop fast-leave after deleting a port group (CKI Backport Bot) [RHEL-246938] {CVE-2026-74480}