kernel-5.14.0-732.el9

* Tue Aug 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-732.el9] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738] - xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116} - espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239} - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797} - redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547] - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801] - timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745] - scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832] - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691] - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684] - watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487] - watchdog: set cdev owner before adding (David Arcari) [RHEL-192487] - watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487] - kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487] - usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798] - usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798] - usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798] - usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109} - usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759} - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798] - usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798] - usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798] - USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798] - dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798] - dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798] - usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798] - usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798] - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798] - cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729} - usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758} - USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798] - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798] - USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798] - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798] - usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798] - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798] - usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488} - usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432} - usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427} - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798] - usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798] - usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798] - USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428} - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429} - USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798] - usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798] - thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798] - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798] - usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798] - net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798] - usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425} - usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798] - USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798] - usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170} - phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798] - usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798] - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798] - USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798] - usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798] - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798] - usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798] - usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798] - usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798] - usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798] - usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798] - tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259} - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798] - net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798] - net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798] - bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798] - net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798] - pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798] - pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798] - usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798] - dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798] - usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798] - usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798] - usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798] - usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798] - usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798] - USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798] - usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798] - usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798] - PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798] - PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798] - USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798] - USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798] - USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798] - thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798] - phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798] - phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798] - docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798] - phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798] - usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798] - dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798] - usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798] - usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113} - nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643] - nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643] - nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643] - nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] - nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643] - nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643] - nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643] - nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643] - nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643] - nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] - nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643] - Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201] - Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201] - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201] - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201] - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201] - Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201] - Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201] - Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201] - Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201] - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201] - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201] - Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201] - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201] - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201] - Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201] - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201] - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201] - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201] - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201] - Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201] - Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201] - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201] - Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201] - Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201] - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201] - Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201] - dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749] - dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749] - dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] - dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] - dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749] - dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749] - dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450] - ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450] - ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450] - ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450] - ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450] - ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450] - ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450] - ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450] - ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450] - ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450] - ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450] - ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450] - ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450] - ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450] - ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450] - ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450] - ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450] - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450] - ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450] - ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346} - drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450] - ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389} - ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450] - ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450] - ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450] - ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450] - ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450] - ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450] - ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450] - ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450] - ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450] - ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450] - ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450] - ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450] - ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450] - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211} - net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694] - net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694] - tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694] - tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240} - tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694] - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694] - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694] - net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694] - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149} - ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925] - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300} - i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251] - i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251] - i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251] - i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251] - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601] - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601] - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601] - netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601] - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601] - neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981} - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601] - netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601] - netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601] - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601] - netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601] - netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601] - netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601] - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601] - netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601] - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496} - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601] - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601] - netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601] - netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601] - netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601] - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601] - ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270} - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218} - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942} - netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219} - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212} - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268} - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912} - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915} - netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970} - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986} - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920} - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999} - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001} - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002} - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601] - netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131} - netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424} - netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601] - netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414} - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601] - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385} - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206} - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601] - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881] - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669} - tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706] - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706] - tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706] - tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706] - tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706] - tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706] - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706] - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695] - sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695] - sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695] - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695] - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695] - sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695] - sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695] - sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695] - net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695] - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695] - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695] - scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105} - scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217] - scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473} - scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218] Resolves: RHEL-113832, RHEL-141217, RHEL-141218, RHEL-147798, RHEL-152694, RHEL-152695, RHEL-152706, RHEL-154836, RHEL-154906, RHEL-168738, RHEL-171507, RHEL-174251, RHEL-176061, RHEL-177450, RHEL-177879, RHEL-178340, RHEL-178626, RHEL-180034, RHEL-180088, RHEL-180161, RHEL-180173, RHEL-180269, RHEL-182043, RHEL-183881, RHEL-184267, RHEL-186601, RHEL-186696, RHEL-189902, RHEL-189938, RHEL-189941, RHEL-190801, RHEL-192402, RHEL-192487, RHEL-192925, RHEL-193749, RHEL-194201, RHEL-210643, RHEL-212684, RHEL-212691, RHEL-213155, RHEL-213547, RHEL-213745 Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
2026-08-04 08:25:47 +00:00 · 2026-08-04 08:25:47 +00:00 · 212dc7242a
commit 212dc7242a
parent 1487aadf1c
5 changed files with 1981 additions and 11 deletions
--- a/Makefile.rhelver
+++ b/Makefile.rhelver
@ -12,7 +12,7 @@ RHEL_MINOR = 9
 #
 # Use this spot to avoid future merge conflicts.
 # Do not trim this comment.
-RHEL_RELEASE = 731
+RHEL_RELEASE = 732

 #
 # ZSTREAM
--- a/kernel.changelog
+++ b/kernel.changelog
@ -1,3 +1,500 @@
+* Tue Aug 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-732.el9]
+- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738]
+- xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340]
+- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116}
+- espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239}
+- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797}
+- xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797}
+- redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547]
+- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
+- gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801]
+- timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214}
+- gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745]
+- scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832]
+- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017}
+- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017}
+- cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691]
+- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684]
+- watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487]
+- watchdog: set cdev owner before adding (David Arcari) [RHEL-192487]
+- watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487]
+- kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487]
+- usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798]
+- usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798]
+- usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798]
+- usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109}
+- usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759}
+- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798]
+- usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798]
+- usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798]
+- dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798]
+- dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798]
+- usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798]
+- usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798]
+- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798]
+- cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729}
+- usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758}
+- USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798]
+- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798]
+- usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798]
+- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798]
+- usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488}
+- usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432}
+- usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427}
+- usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798]
+- usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798]
+- usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798]
+- USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428}
+- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429}
+- USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798]
+- usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798]
+- thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798]
+- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798]
+- usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798]
+- net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798]
+- usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425}
+- usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798]
+- USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170}
+- phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798]
+- usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798]
+- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798]
+- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798]
+- usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798]
+- usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798]
+- usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798]
+- usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798]
+- usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798]
+- tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259}
+- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798]
+- net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798]
+- net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798]
+- bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798]
+- net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798]
+- pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798]
+- pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798]
+- usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798]
+- dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798]
+- usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798]
+- USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798]
+- usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798]
+- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798]
+- PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798]
+- USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798]
+- USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798]
+- USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798]
+- thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798]
+- phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798]
+- phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798]
+- docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798]
+- phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798]
+- usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798]
+- dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798]
+- usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798]
+- usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798]
+- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359}
+- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113}
+- nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643]
+- nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643]
+- nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643]
+- nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643]
+- nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643]
+- nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643]
+- nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643]
+- nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643]
+- Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201]
+- Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201]
+- Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201]
+- Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201]
+- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201]
+- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201]
+- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201]
+- Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201]
+- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201]
+- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201]
+- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201]
+- Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201]
+- Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201]
+- Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201]
+- dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749]
+- dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749]
+- dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749]
+- dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749]
+- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749]
+- dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749]
+- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749]
+- dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749]
+- dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749]
+- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749]
+- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749]
+- dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749]
+- ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450]
+- ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450]
+- ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450]
+- ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450]
+- ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450]
+- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450]
+- ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450]
+- ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450]
+- ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450]
+- ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450]
+- ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450]
+- ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450]
+- ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450]
+- ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450]
+- ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450]
+- ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450]
+- ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450]
+- ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450]
+- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007}
+- ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008}
+- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450]
+- ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450]
+- ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009}
+- ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162}
+- ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450]
+- ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450]
+- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450]
+- ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346}
+- drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450]
+- ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389}
+- ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450]
+- ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450]
+- ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450]
+- ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450]
+- ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450]
+- ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450]
+- ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450]
+- ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450]
+- ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450]
+- ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450]
+- ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450]
+- ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450]
+- ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450]
+- ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450]
+- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450]
+- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211}
+- net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694]
+- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694]
+- tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694]
+- tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240}
+- tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694]
+- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694]
+- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694]
+- net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694]
+- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149}
+- ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694]
+- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925]
+- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323}
+- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503}
+- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503}
+- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300}
+- i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251]
+- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601]
+- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601]
+- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601]
+- netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601]
+- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601]
+- neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981}
+- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601]
+- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601]
+- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601]
+- netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601]
+- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601]
+- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601]
+- netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601]
+- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496}
+- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601]
+- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601]
+- ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270}
+- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134}
+- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218}
+- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942}
+- netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219}
+- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601]
+- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220}
+- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267}
+- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212}
+- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268}
+- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269}
+- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601]
+- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601]
+- netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912}
+- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601]
+- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915}
+- netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970}
+- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601]
+- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601]
+- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601]
+- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601]
+- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986}
+- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920}
+- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324}
+- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601]
+- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998}
+- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999}
+- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001}
+- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002}
+- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841}
+- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601]
+- netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131}
+- netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665}
+- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681}
+- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085}
+- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024}
+- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424}
+- netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418}
+- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025}
+- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026}
+- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601]
+- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028}
+- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416}
+- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601]
+- netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414}
+- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601]
+- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674}
+- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278}
+- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351}
+- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385}
+- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206}
+- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206}
+- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601]
+- netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655}
+- netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201}
+- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162}
+- netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601]
+- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267]
+- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043]
+- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043]
+- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881]
+- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881]
+- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276}
+- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276}
+- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117}
+- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145}
+- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669}
+- tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706]
+- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706]
+- tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706]
+- tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706]
+- tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706]
+- tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706]
+- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706]
+- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695]
+- sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695]
+- sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695]
+- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695]
+- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695]
+- sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695]
+- sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695]
+- sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695]
+- net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695]
+- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695]
+- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695]
+- scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105}
+- scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473}
+- scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218]
+Resolves: RHEL-113832, RHEL-141217, RHEL-141218, RHEL-147798, RHEL-152694, RHEL-152695, RHEL-152706, RHEL-154836, RHEL-154906, RHEL-168738, RHEL-171507, RHEL-174251, RHEL-176061, RHEL-177450, RHEL-177879, RHEL-178340, RHEL-178626, RHEL-180034, RHEL-180088, RHEL-180161, RHEL-180173, RHEL-180269, RHEL-182043, RHEL-183881, RHEL-184267, RHEL-186601, RHEL-186696, RHEL-189902, RHEL-189938, RHEL-189941, RHEL-190801, RHEL-192402, RHEL-192487, RHEL-192925, RHEL-193749, RHEL-194201, RHEL-210643, RHEL-212684, RHEL-212691, RHEL-213155, RHEL-213547, RHEL-213745
+
 * Wed Jul 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-731.el9]
 - crypto: rng - Enable pre-emption ASAP (Herbert Xu) [RHEL-92680]
 - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213301] {CVE-2026-64530}
--- a/kernel.spec
+++ b/kernel.spec
@ -176,15 +176,15 @@ Summary: The Linux kernel
 # define buildid .local
 %define specversion 5.14.0
 %define patchversion 5.14
-%define pkgrelease 731
+%define pkgrelease 732
 %define kversion 5
-%define tarfile_release 5.14.0-731.el9
+%define tarfile_release 5.14.0-732.el9
 # This is needed to do merge window version magic
 %define patchlevel 14
 # This allows pkg_release to have configurable %%{?dist} tag
-%define specrelease 731%{?buildid}%{?dist}
+%define specrelease 732%{?buildid}%{?dist}
 # This defines the kabi tarball version
-%define kabiversion 5.14.0-731.el9
+%define kabiversion 5.14.0-732.el9

 #
 # End of genspec.sh variables
@ -225,6 +225,8 @@ Summary: The Linux kernel
 %define with_tools     %{?_without_tools:     0} %{?!_without_tools:     1}
 # kernel-debuginfo
 %define with_debuginfo %{?_without_debuginfo: 0} %{?!_without_debuginfo: 1}
+# kernel-kmap-internal: source-to-module mapping data (JSON)
+%define with_kmap      %{?_without_kmap:      0} %{?!_without_kmap:      1}
 # kernel-abi-stablelists
 %define with_kernel_abi_stablelists %{?_without_kernel_abi_stablelists: 0} %{?!_without_kernel_abi_stablelists: 1}
 # internal samples and selftests
@ -568,6 +570,10 @@ Summary: The Linux kernel
 %define _enable_debug_packages 0
 %endif

+%ifnarch x86_64 ppc64le s390x aarch64
+%define with_kmap 0
+%endif
+
 # Architectures we build tools/cpupower on
 %if 0%{?fedora}
 %define cpupowerarchs %{ix86} x86_64 ppc64le %{arm} aarch64
@ -598,6 +604,13 @@ Summary: The Linux kernel
 %define with_debug 0
 %endif

+# Define with_base to indicate if any non-debug variant is being built.
+# Used to conditionally build packages that only make sense for base variants.
+%if %{with_zfcpdump} || %{with_pae} || %{with_up} || %{with_arm64_64k} || %{with_realtime} || %{with_realtime_arm64_64k}
+%define with_base 1
+%else
+%define with_base 0
+%endif

 #
 # Packages that need to be installed before the kernel is, because the %%post
@ -941,6 +954,9 @@ Source2000: cpupower.service
 Source2001: cpupower.config
 Source2002: kvm_stat.logrotate

+# Sources for kernel-kmap-internal
+Source2100: kmap.py
+
 # Some people enjoy building customized kernels from the dist-git in Fedora and
 # use this to override configuration options. One day they may all use the
 # source tree, but in the mean time we carry this to support the legacy workflow
@ -1217,6 +1233,27 @@ This package provides debug information for the rv package.
 # with_tools
 %endif

+%if %{with_kmap} && %{with_base}
+%package -n %{name}-kmap-internal
+Summary: Kernel source-to-module mapping data and module list
+Group: Development/System
+BuildRequires: python3
+%description -n %{name}-kmap-internal
+The %{name}-kmap-internal package contains a JSON mapping file that describes
+which C source files contributed to each kernel module and to the built-in
+vmlinux image, and which RPM package each module is shipped in.
+
+Files installed under /usr/share/%{name}-kmap-internal/:
+  kernel-map-<KVERREL>.json - unified mapping file for all kernel variants containing:
+    - variants:    list of variant names (e.g., ["stock", "rt"])
+    - source-map:  source file mappings
+      - obj-src:   maps kernel objects to source files with variant indices
+      - src-obj:   maps source files to kernel objects with variant indices
+    - module-map:  module to RPM mappings
+      - module-rpm:  maps module names to RPM package names with variant indices
+      - rpm-modules: maps RPM package names to module names with variant indices
+%endif
+
 %if %{with_selftests}

 %package selftests-internal
@ -2603,6 +2640,44 @@ BuildKernel() {
 %if %{with_gcov}
    popd
 %endif
+
+%if %{with_kmap} && %{with_base}
+    # Generate source-to-module mapping data using kmap.py.
+    # Must run before the next BuildKernel call issues make mrproper, which
+    # would wipe the .cmd files that kmap.py reads.  Skip debug variants
+    # (same source mapping as the base kernel).
+    if [[ "$Variant" != *debug* ]]; then
+        _kmap_bdir=$(pwd)
+        _kmap_basedir=%{_builddir}/kmap-data
+        _kmap_merged=$_kmap_basedir/kernel-map.json
+        _kmap_variant=${Variant:-stock}
+        _kmap_listprefix=../kernel${Variant:+-${Variant}}
+        mkdir -p $_kmap_basedir
+
+        # Build kmap.py arguments; merge with existing data if present
+        _kmap_args="--directory $_kmap_bdir --outputdir $_kmap_basedir --rhel 9 --variant $_kmap_variant --time"
+        _kmap_args="$_kmap_args --vmlinux-rpm %{name}-core-%{KVERREL}.rpm"
+        if [ -f "$_kmap_merged" ]; then
+            _kmap_args="$_kmap_args --input kernel-map.json"
+        fi
+
+        # Add module list files for module-to-RPM mapping
+        for _kmap_type in modules-core modules modules-extra modules-internal; do
+            if [ -f "${_kmap_listprefix}-${_kmap_type}.list" ]; then
+                _kmap_rpm=%{name}-${_kmap_type}-%{KVERREL}.rpm
+                _kmap_args="$_kmap_args --module-list ${_kmap_rpm}:${_kmap_listprefix}-${_kmap_type}.list"
+            fi
+        done
+%if 0%{!?fedora:1}
+        if [ -f "${_kmap_listprefix}-modules-partner.list" ]; then
+            _kmap_rpm=%{name}-modules-partner-%{KVERREL}.rpm
+            _kmap_args="$_kmap_args --module-list ${_kmap_rpm}:${_kmap_listprefix}-modules-partner.list"
+        fi
+%endif
+
+        python3 %{SOURCE2100} $_kmap_args
+    fi
+%endif
 }

 ###
@ -2770,9 +2845,15 @@ for dir in bpf bpf/no_alu32 bpf/cpuv4 bpf/progs; do
 	# other issues. If something did not get built, just skip it.
 	test -d $dir || continue
 	mkdir -p %{buildroot}%{_libexecdir}/kselftests/$dir
-	find $dir -maxdepth 1 -type f \( -executable -o -name '*.py' -o -name settings -o \
-		-name 'btf_dump_test_case_*.c' -o -name '*.ko' -o \
-		-name '*.o' -exec sh -c 'readelf -h "{}" | grep -q "^  Machine:.*BPF"' \; \) -print0 | \
+	find $dir -maxdepth 1 -type f \( \
+		-executable -o \
+		-name '*.py' -o \
+		-name settings -o \
+		-name DENYLIST -o \
+		-name 'btf_dump_test_case_*.c' -o \
+		-name '*.ko' -o \
+		-name '*.o' -exec sh -c 'readelf -h "{}" | grep -q "^  Machine:.*BPF"' \; \
+	\) -print0 | \
 	xargs -0 cp -t %{buildroot}%{_libexecdir}/kselftests/$dir || true
 done
 ln -sr  %{buildroot}%{_libexecdir}/kselftests/bpf/bpftool %{buildroot}%{_libexecdir}/kselftests/bpf/no_alu32/bpftool
@ -2783,6 +2864,13 @@ ln -sr  %{buildroot}%{_libexecdir}/kselftests/bpf/bpftool %{buildroot}%{_libexec
 %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs"
 %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-no_alu32"
 %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-cpuv4"
+
+# Append RHEL-specific BPF selftests DENYLIST.rhel to the global DENYLIST that
+# is automatically picked by BPF selftest runners.
+%if 0%{?rhel}%{?centos}
+    cat ./bpf/DENYLIST.rhel >> %{buildroot}%{_libexecdir}/kselftests/bpf/DENYLIST
+%endif
+
 popd
 %endif

@ -3170,6 +3258,14 @@ find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/
 popd
 %endif

+%if %{with_kmap} && %{with_base}
+# Install kmap data files produced during %build.
+_kmap_basedir=%{_builddir}/kmap-data
+_kmap_destbase=$RPM_BUILD_ROOT%{_datadir}/%{name}-kmap-internal
+mkdir -p $_kmap_destbase
+install -m 644 $_kmap_basedir/kernel-map.json $_kmap_destbase/kernel-map-%{KVERREL}.json
+%endif
+
 ###
 ### clean
 ###
@ -3601,6 +3697,13 @@ fi
 %{_libexecdir}/kselftests
 %endif

+%if %{with_kmap} && %{with_base}
+%files -n %{name}-kmap-internal
+%defattr(-,root,root)
+%dir %{_datadir}/%{name}-kmap-internal
+%{_datadir}/%{name}-kmap-internal/kernel-map-%{KVERREL}.json
+%endif
+
 # empty meta-package
 %if %{with_up}
 %ifnarch %nobuildarches noarch
@ -3753,6 +3856,502 @@ fi
 #
 #
 %changelog
+* Tue Aug 04 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-732.el9]
+- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738]
+- xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340]
+- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116}
+- espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239}
+- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797}
+- xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797}
+- redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547]
+- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky)
+- gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801]
+- gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801]
+- timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214}
+- gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745]
+- scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832]
+- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017}
+- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017}
+- cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691]
+- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684]
+- watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487]
+- watchdog: set cdev owner before adding (David Arcari) [RHEL-192487]
+- watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487]
+- kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487]
+- usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798]
+- usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798]
+- usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798]
+- usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109}
+- usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759}
+- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798]
+- usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798]
+- usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798]
+- dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798]
+- dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798]
+- usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798]
+- usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798]
+- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798]
+- cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729}
+- usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758}
+- USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798]
+- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798]
+- usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798]
+- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798]
+- usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488}
+- usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432}
+- usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427}
+- usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798]
+- usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798]
+- usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798]
+- USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428}
+- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429}
+- USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798]
+- usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798]
+- thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798]
+- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798]
+- usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798]
+- net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798]
+- usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425}
+- usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798]
+- USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170}
+- phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798]
+- usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798]
+- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798]
+- USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798]
+- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798]
+- usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798]
+- usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798]
+- usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798]
+- usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798]
+- usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798]
+- usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798]
+- usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798]
+- tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798]
+- xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259}
+- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798]
+- net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798]
+- net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798]
+- bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798]
+- net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798]
+- pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798]
+- pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798]
+- usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798]
+- dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798]
+- usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798]
+- USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798]
+- usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798]
+- usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798]
+- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798]
+- PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798]
+- USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798]
+- USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798]
+- USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798]
+- thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798]
+- phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798]
+- phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798]
+- docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798]
+- phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798]
+- phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798]
+- usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798]
+- usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798]
+- dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798]
+- usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798]
+- usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798]
+- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359}
+- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113}
+- nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643]
+- nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643]
+- nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643]
+- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643]
+- nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643]
+- nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643]
+- nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643]
+- nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643]
+- nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643]
+- Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201]
+- Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201]
+- Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201]
+- Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201]
+- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201]
+- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201]
+- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201]
+- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201]
+- Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201]
+- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201]
+- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201]
+- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201]
+- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201]
+- Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201]
+- Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201]
+- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201]
+- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201]
+- Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201]
+- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201]
+- Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201]
+- Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201]
+- dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749]
+- dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749]
+- dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749]
+- dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749]
+- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749]
+- dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749]
+- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749]
+- dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749]
+- dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749]
+- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749]
+- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749]
+- dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749]
+- dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749]
+- ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450]
+- ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450]
+- ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450]
+- ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450]
+- ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450]
+- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450]
+- ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450]
+- ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450]
+- ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450]
+- ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450]
+- ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450]
+- ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450]
+- ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450]
+- ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450]
+- ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450]
+- ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450]
+- ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450]
+- ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450]
+- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007}
+- ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008}
+- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450]
+- ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450]
+- ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009}
+- ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162}
+- ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450]
+- ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450]
+- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450]
+- ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346}
+- drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450]
+- ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389}
+- ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450]
+- ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450]
+- ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450]
+- ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450]
+- ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450]
+- ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450]
+- ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450]
+- ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450]
+- ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450]
+- ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450]
+- ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450]
+- ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450]
+- ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450]
+- ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450]
+- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450]
+- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211}
+- net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694]
+- net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694]
+- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694]
+- tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694]
+- tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240}
+- tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694]
+- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694]
+- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694]
+- net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694]
+- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149}
+- ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694]
+- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925]
+- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323}
+- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503}
+- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503}
+- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300}
+- i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251]
+- i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251]
+- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601]
+- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601]
+- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601]
+- netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601]
+- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601]
+- neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981}
+- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601]
+- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601]
+- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601]
+- netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601]
+- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601]
+- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601]
+- netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601]
+- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496}
+- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601]
+- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601]
+- ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270}
+- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134}
+- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218}
+- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942}
+- netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219}
+- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601]
+- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220}
+- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267}
+- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212}
+- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268}
+- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269}
+- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601]
+- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601]
+- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601]
+- netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912}
+- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601]
+- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915}
+- netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601]
+- netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970}
+- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601]
+- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601]
+- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601]
+- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601]
+- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601]
+- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601]
+- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986}
+- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920}
+- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324}
+- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601]
+- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998}
+- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999}
+- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001}
+- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002}
+- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841}
+- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601]
+- netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131}
+- netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665}
+- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681}
+- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085}
+- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024}
+- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424}
+- netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418}
+- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025}
+- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026}
+- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601]
+- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028}
+- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416}
+- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601]
+- netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601]
+- netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414}
+- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601]
+- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674}
+- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278}
+- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351}
+- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385}
+- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601]
+- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206}
+- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206}
+- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601]
+- netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601]
+- selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655}
+- netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201}
+- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162}
+- netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601]
+- netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601]
+- netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601]
+- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267]
+- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043]
+- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043]
+- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043]
+- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881]
+- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881]
+- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276}
+- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276}
+- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117}
+- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145}
+- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669}
+- tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706]
+- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706]
+- tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706]
+- tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706]
+- tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706]
+- tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706]
+- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706]
+- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695]
+- sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695]
+- sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695]
+- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695]
+- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695]
+- sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695]
+- sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695]
+- sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695]
+- net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695]
+- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695]
+- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695]
+- scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105}
+- scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217]
+- scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473}
+- scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218]
+- scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218]
+
 * Wed Jul 29 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-731.el9]
 - crypto: rng - Enable pre-emption ASAP (Herbert Xu) [RHEL-92680]
 - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213301] {CVE-2026-64530}
--- a/kmap.py
+++ b/kmap.py
@ -0,0 +1,874 @@
+#!/usr/bin/env python3
+
+"""
+kmap.py - Kernel Source-to-Binary Mapping Tool
+
+DESCRIPTION
+    This tool parses Linux kernel build artifacts (.cmd files, archives) to
+    create a JSON mapping of which source files contribute to which kernel
+    binaries (modules and vmlinux). It supports merging data from multiple
+    kernel build variants (e.g., stock, debug, rt) into a single output
+    file using variant indices to track per-variant mappings.
+
+    Supported RHEL versions: 7, 8, 9, upstream
+
+FEATURES
+    - Parses .cmd files generated by kbuild to extract compilation commands
+    - Supports C (gcc/clang) and Rust (rustc) source files
+    - Handles built-in objects via built-in.o.cmd (RHEL 7), built-in.a
+      (RHEL 8/9), or vmlinux.a (upstream)
+    - Merges multiple kernel variants into single output with variant indices
+    - Maps modules to their containing RPM packages
+
+OUTPUT FORMAT
+    The output is a JSON file with the following structure:
+
+    {
+      "variants": ["stock", "rt", ...],
+      "source-map": {
+        "obj-src": {<object>: {<source>: [<variant_indices>]}},
+        "src-obj": {<source>: {<object>: [<variant_indices>]}}
+      },
+      "module-map": {
+        "module-rpm": {<module>: {<rpm_name>: [<variant_indices>]}},
+        "rpm-modules": {<rpm_name>: {<module>: [<variant_indices>]}}
+      }
+    }
+
+PARSING THE OUTPUT
+    import json
+
+    with open('kernel-map.json') as f:
+        data = json.load(f)
+
+    variants = data['variants']
+    obj_src = data['source-map']['obj-src']
+    src_obj = data['source-map']['src-obj']
+    module_rpm = data['module-map']['module-rpm']
+    rpm_modules = data['module-map']['rpm-modules']
+
+    # Get sources for vmlinux in variant "stock" (index 0)
+    vmlinux_sources = [src for src, indices in obj_src['vmlinux'].items()
+                       if 0 in indices]
+
+    # Find which object a source contributes to
+    fork_objects = [obj for obj, indices in src_obj['kernel/fork.c'].items()
+                    if 0 in indices]
+
+    # Get RPM for a module
+    def get_rpm(module, variant_idx):
+        for rpm, indices in module_rpm.get(module, {}).items():
+            if variant_idx in indices:
+                return rpm
+        return None
+
+USAGE
+    # Single variant
+    ./kmap.py -d /build/stock -r upstream -v stock -o /output
+
+    # Merge multiple variants
+    ./kmap.py -d /build/stock -r upstream -v stock -o /output
+    ./kmap.py -d /build/debug -r upstream -v debug -o /output -i kernel-map.json
+    ./kmap.py -d /build/rt -r upstream -v rt -o /output -i kernel-map.json
+
+    # With module-to-RPM mapping
+    ./kmap.py -d /build -r upstream -v stock -o /output \\
+        --vmlinux-rpm kernel-core-5.14.0.rpm \\
+        --module-list kernel-modules-5.14.0.rpm:modules.list
+
+CREDITS
+    Inspired by gen_compile_commands.py and Joe Lawrence.
+    Time measurement option added for Jan Stancek.
+"""
+
+import re
+import os
+import pathlib
+import json
+import argparse
+import subprocess
+import time
+
+
+# =============================================================================
+# Constants
+# =============================================================================
+
+VMLINUX = 'vmlinux'
+KERNEL_PREFIX = 'kernel/'
+
+# Supported compilers and linkers
+COMPILERS = ('gcc', 'clang')
+LINKER = 'ld'
+RUST_COMPILER = 'rustc'
+
+
+# =============================================================================
+# Regex Patterns
+#
+# These patterns parse the kernel build .cmd files to extract:
+# - What compiler/linker was used
+# - What source files were compiled
+# - What object files were linked
+# =============================================================================
+
+# Pattern for .ko.cmd files (module linking)
+# Matches: cmd_path/to/module.ko := ld <params> -o <ko_name> <input_files>
+# Note: upstream kernels use 'savedcmd_' prefix instead of 'cmd_'
+_KO_CMD_PATTERN = (
+    r'^(saved)?cmd_[^ ]*\.ko\s*:=\s*ld\s+'
+    r'(?P<params>.*) -o (?P<ko_name>\S+) (?P<input_files>[^;]+?)\s*(?:;|$)'
+)
+
+# Pattern for .o.cmd files (object compilation)
+# Matches multiple formats:
+# - C/asm: cmd_*.o := gcc/clang <params> -o <output> <input>
+# - Rust:  cmd_*.o := rustc <params> --emit=obj=<output> <input.rs>
+# - Rust source mapping: source_*.o := <file.rs>
+_O_CMD_PATTERN = (
+    r'^(saved)?(?:cmd_|source_)[^ ]*\.o\s+:=\s+'
+    r'(?:'
+        r'(?P<prefix>(?:\S+=\S+\s+)*)?'
+        r'(?P<command>gcc|clang|ld|rustc)\s+'
+        r'(?P<params>.*?)'
+        r'(?:'
+            r'\s+-o\s+(?P<obj_out>\S+)\s+(?P<input_files>[^;]+?)'
+            r'|'
+            r'\s+--emit=obj=(?P<rust_obj_out>\S+).*?\s+(?P<rust_input_file>\S+\.rs)'
+        r')'
+        r'|'
+        r'(?P<source_file>\S+\.rs)'
+    r')\s*(?:;|$)'
+)
+
+ko_matcher = re.compile(_KO_CMD_PATTERN)
+o_matcher = re.compile(_O_CMD_PATTERN)
+
+
+# =============================================================================
+# Utility Functions
+# =============================================================================
+
+def parse_args():
+    """
+    Parse command line arguments
+    """
+    parser = argparse.ArgumentParser(
+            prog='Kernel Build Mapper',
+            description='Scrape Linux Kernel .cmd files to map contribution '
+                        'of individual source files to kernel binaries.',
+            )
+
+    parser.add_argument('-d', '--directory',
+            help='Directory with kernel build artifacts.',
+            default='',
+            type=str)
+
+    parser.add_argument('-o', '--outputdir',
+            help='Directory where to put generated files.',
+            default='',
+            type=str)
+
+    parser.add_argument('-p', '--prefix',
+            help='Name prefix to the generated files.',
+            default='',
+            type=str)
+
+    parser.add_argument('-r', '--rhel',
+            help='Specify to what version of RHEL artifacts belong (upstream for RHEL 10+/kernel-ark)',
+            choices=['7', '8', '9', 'upstream'],
+            required=True)
+
+    parser.add_argument('-m', '--no-modules',
+            help='*SKIP* collecting information about modules',
+            action='store_true')
+
+    parser.add_argument('-b', '--no-builtin',
+            help='*SKIP* collecting information about built-in',
+            action='store_true')
+
+    parser.add_argument('-t', '--time',
+            help='Print elapsed time at the end',
+            action='store_true')
+
+    parser.add_argument('-v', '--variant',
+            help='Name of this kernel variant (e.g., stock, debug, rt)',
+            required=True,
+            type=str)
+
+    parser.add_argument('-i', '--input',
+            help='Existing JSON file to merge with (from previous variant runs)',
+            default='',
+            type=str)
+
+    parser.add_argument('--module-list',
+            help='Module list in format <rpm-name>:<path> (can be specified multiple times)',
+            action='append',
+            default=[],
+            metavar='RPM:PATH')
+
+    parser.add_argument('--vmlinux-rpm',
+            help='RPM package name for vmlinux (e.g., "kernel-5.14.0.rpm")',
+            default='',
+            type=str)
+
+    return parser.parse_args()
+
+
+def load_file(filename, build_dir=''):
+    """
+    Load a text file and return non-empty lines as a list
+    """
+    full_path = os.path.join(build_dir, filename)
+
+    try:
+        with open(full_path, 'rt', encoding='utf-8') as file:
+            return [line.rstrip() for line in file if line.rstrip()]
+    except FileNotFoundError:
+        print(f'File "{full_path}" not found.')
+        return []
+
+
+def name_to_cmd(filename, suffix):
+    """
+    Convert object filename to corresponding .cmd script filename
+
+    Example: kernel/fork.o -> kernel/.fork.o.cmd
+    """
+    path, _ = os.path.splitext(filename)
+    dirname = os.path.dirname(path)
+    basename = os.path.basename(path)
+
+    return os.path.join(dirname, '.' + basename + suffix)
+
+
+def strip_path_prefixes(path, build_dir):
+    """
+    Normalize path by removing build directory prefix and other artifacts
+    """
+    path = pathlib.Path(path)
+
+    if build_dir:
+        try:
+            return str(path.resolve().relative_to(pathlib.Path(build_dir).resolve()))
+        except ValueError:
+            pass
+
+    if path.is_absolute():
+        path = pathlib.Path(*path.parts[1:])
+
+    while path.parts and path.parts[0] == 'repos':
+        path = pathlib.Path(*path.parts[1:])
+
+    return str(path)
+
+
+def is_external_source(path):
+    """
+    Check if path should be excluded from source mapping
+
+    Filters out:
+    - Rust toolchain sources (not part of kernel source)
+    - Generated assembly files (e.g., initramfs_data.S)
+    """
+    if 'rustlib' in path:
+        return True
+    if path.endswith('_data.S'):
+        return True
+    return False
+
+
+def is_mod_file_reference(ld_input):
+    """
+    Check if linker input is a .mod file reference (RHEL 9+ module linking)
+
+    In RHEL 9+, module linking uses @path/to/module.mod files that contain
+    the list of object files to link.
+    """
+    files = ld_input.split()
+    return len(files) == 1 and files[0].startswith('@') and files[0].endswith('.mod')
+
+
+# =============================================================================
+# SourceMap Class
+# =============================================================================
+
+class SourceMap:
+    """
+    Collects and manages kernel source-to-binary mappings.
+
+    This class parses kernel build artifacts (.cmd files, archives) to determine
+    which source files contribute to which kernel binaries (modules and vmlinux).
+
+    Data structures:
+        obj_to_src: {object_name: {source_file: [variant_indices]}}
+        src_to_obj: {source_file: {object_name: [variant_indices]}}
+        module_rpm: {module_name: {rpm_name: [variant_indices]}}
+        rpm_to_modules: {rpm_name: {module_name: [variant_indices]}}
+
+    Variant indices correspond to positions in the 'variants' list.
+    """
+
+    # Dispatch table for RHEL-specific builtin collection methods
+    BUILTIN_COLLECTORS = {
+        '7': '_collect_builtin_rhel7',
+        '8': '_collect_builtin_archive',
+        '9': '_collect_builtin_archive',
+        'upstream': '_collect_builtin_vmlinux_archive',
+    }
+
+    def __init__(self, build_dir='', output_dir='', outprefix='', rhel='7', variant=''):
+        # Source mappings
+        self.obj_to_src = {}
+        self.src_to_obj = {}
+        # Module-to-RPM mappings
+        self.module_rpm = {}
+        self.rpm_to_modules = {}
+
+        # Configuration
+        self.build_dir = build_dir
+        self.output_dir = output_dir
+        self.outprefix = outprefix
+        self.rhel = rhel
+
+        # Module list
+        self.modlist = set()
+
+        # Variant tracking for multi-variant merging
+        self.variants = []
+        self.variant = variant
+        self.variant_idx = 0
+
+    # -------------------------------------------------------------------------
+    # Variant Management
+    # -------------------------------------------------------------------------
+
+    def load_existing(self, filename):
+        """
+        Load existing merged data from previous variant runs
+        """
+        if not filename:
+            return
+
+        full_path = os.path.join(self.output_dir, filename) if self.output_dir else filename
+
+        if not os.path.exists(full_path):
+            return
+
+        with open(full_path, 'rt', encoding='utf-8') as f:
+            data = json.load(f)
+
+        self.variants = data.get('variants', [])
+
+        module_map = data.get('module-map', {})
+        self.module_rpm = module_map.get('module-rpm', {})
+        self.rpm_to_modules = module_map.get('rpm-modules', {})
+
+        source_map = data.get('source-map', {})
+        self.obj_to_src = source_map.get('obj-src', {})
+        self.src_to_obj = source_map.get('src-obj', {})
+
+    def add_variant(self):
+        """
+        Register current variant and store its index
+        """
+        if self.variant in self.variants:
+            self.variant_idx = self.variants.index(self.variant)
+        else:
+            self.variant_idx = len(self.variants)
+            self.variants.append(self.variant)
+
+    # -------------------------------------------------------------------------
+    # Source Merging Helpers
+    # -------------------------------------------------------------------------
+
+    def _merge_sources(self, target, source):
+        """
+        Merge source dict into target dict by combining variant index lists
+        """
+        for src, indices in source.items():
+            if src not in target:
+                target[src] = []
+            for idx in indices:
+                if idx not in target[src]:
+                    target[src].append(idx)
+
+    def _add_source(self, sources, source_path):
+        """
+        Add a source file to the sources dict with current variant index
+
+        Returns True if source was added, False if filtered out
+        """
+        source_path = os.path.normpath(source_path)
+        source_path = strip_path_prefixes(source_path, self.build_dir)
+
+        if is_external_source(source_path):
+            return False
+
+        sources[source_path] = [self.variant_idx]
+        return True
+
+    # -------------------------------------------------------------------------
+    # .cmd File Parsing
+    # -------------------------------------------------------------------------
+
+    def _parse_ko_cmd(self, ko_name):
+        """
+        Parse .ko.cmd file to find the primary object file linked into the module
+        """
+        ko_script = name_to_cmd(ko_name, '.ko.cmd')
+        lines = load_file(ko_script, build_dir=self.build_dir)
+
+        for line in lines:
+            result = ko_matcher.match(line)
+            if result:
+                input_files = result.group('input_files').split()
+                return input_files[0]
+
+        return None
+
+    def _parse_o_cmd(self, o_name, translate=True):
+        """
+        Parse .o.cmd file to extract source files that contribute to the object
+
+        Handles:
+        - C/assembly compilation (gcc, clang)
+        - Linking (ld) - recursively parses linked objects
+        - Rust compilation (rustc)
+        - Rust source file mappings
+
+        Args:
+            o_name: Object file name or .cmd file path
+            translate: If True, convert object name to .cmd path (e.g., kernel/fork.o
+                       becomes kernel/.fork.o.cmd). If False, use o_name as-is.
+                       This parameter exists to handle different kbuild behaviors
+                       across RHEL versions - some code paths may already have .cmd
+                       paths while others have object names that need translation.
+        """
+        sources = {}
+
+        o_script = name_to_cmd(o_name, '.o.cmd') if translate else o_name
+        lines = load_file(o_script, build_dir=self.build_dir)
+
+        for line in lines:
+            result = o_matcher.match(line)
+            if not result:
+                continue
+
+            command = result.group('command')
+
+            if command in COMPILERS:
+                self._handle_compiler(result, sources)
+                break
+
+            elif command == LINKER:
+                self._handle_linker(result, sources)
+                break
+
+            elif command == RUST_COMPILER:
+                self._handle_rustc(result, sources)
+                break
+
+            else:
+                self._handle_rust_source_mapping(result, sources)
+                break
+
+        return sources
+
+    def _handle_compiler(self, match_result, sources):
+        """
+        Handle gcc/clang compilation - extract the input source file
+        """
+        obj_input = match_result.group('input_files')
+        if obj_input:
+            self._add_source(sources, obj_input)
+
+    def _handle_linker(self, match_result, sources):
+        """
+        Handle ld linking - recursively parse linked objects
+        """
+        obj_input = match_result.group('input_files')
+        if not obj_input:
+            return
+
+        if is_mod_file_reference(obj_input):
+            self._merge_sources(sources, self._parse_mod_cmd(obj_input))
+        else:
+            for obj_file in obj_input.split():
+                self._merge_sources(sources, self._parse_o_cmd(obj_file))
+
+    def _handle_rustc(self, match_result, sources):
+        """
+        Handle rustc compilation - extract the Rust source file
+        """
+        rust_input = match_result.group('rust_input_file')
+        if rust_input:
+            self._add_source(sources, rust_input)
+
+    def _handle_rust_source_mapping(self, match_result, sources):
+        """
+        Handle Rust source file mapping (source_*.o := *.rs)
+        """
+        source_file = match_result.group('source_file')
+        if source_file and source_file.endswith('.rs'):
+            self._add_source(sources, source_file)
+
+    def _parse_mod_cmd(self, mod_name):
+        """
+        Parse .mod file used by RHEL 9+ for linking modules
+
+        These files contain a list of object files to link into the module.
+        """
+        sources = {}
+        mod_name = mod_name.strip('@')
+        lines = load_file(mod_name, build_dir=self.build_dir)
+
+        for line in lines:
+            self._merge_sources(sources, self._parse_o_cmd(line))
+
+        return sources
+
+    def _parse_a_cmd(self, a_name):
+        """
+        Parse archive .cmd file (RHEL 7 built-in.o.cmd files)
+        """
+        sources = {}
+        lines = load_file(a_name, build_dir=self.build_dir)
+
+        for line in lines:
+            result = o_matcher.match(line)
+            if not result:
+                continue
+
+            ar_input = result.group('input_files')
+            for filename in ar_input.rsplit():
+                if filename.endswith('.o'):
+                    self._merge_sources(sources, self._parse_o_cmd(filename))
+                elif filename.endswith('.a'):
+                    self._merge_sources(sources, self._parse_a_cmd(filename))
+
+        return sources
+
+    # -------------------------------------------------------------------------
+    # Module Collection
+    # -------------------------------------------------------------------------
+
+    def _load_module_list(self, modorder='modules.order'):
+        """
+        Load modules.order file and normalize paths
+
+        RHEL 7, 8: modules.order has 'kernel/' prefix that needs to be stripped
+        RHEL 9, upstream: modules.order paths are used as-is
+        """
+        lines = load_file(modorder, build_dir=self.build_dir)
+
+        if not lines:
+            print(f'Warning: modules.order is empty or not found')
+            self.modlist = set()
+            return
+
+        if self.rhel in ['9', 'upstream']:
+            self.modlist = set(lines)
+        else:
+            # RHEL 7, 8: strip fake 'kernel/' prefix added by kbuild
+            self.modlist = {
+                path[len(KERNEL_PREFIX):] if path.startswith(KERNEL_PREFIX) else path
+                for path in lines
+            }
+
+    def _parse_module_objects(self):
+        """
+        Parse all module .cmd files and extract source mappings.
+
+        Note on RHEL version differences:
+        - RHEL 7/8/9: modules.order contains .ko paths (e.g., fs/exfat/exfat.ko)
+        - upstream: modules.order contains .o paths (e.g., fs/exfat/exfat.o)
+
+        The normalization below ensures consistent .ko keys in output regardless
+        of the modules.order format.
+        """
+        for kobj in self.modlist:
+            # Normalize to .ko - upstream has .o paths in modules.order
+            if self.rhel == 'upstream' and kobj.endswith('.o'):
+                module_name = kobj[:-2] + '.ko'
+            else:
+                module_name = kobj
+
+            obj_name = self._parse_ko_cmd(module_name)
+            if obj_name is None:
+                print(f'Warning: Could not parse .ko.cmd for "{module_name}", skipping.')
+                continue
+
+            obj_source = self._parse_o_cmd(obj_name)
+            if module_name not in self.obj_to_src:
+                self.obj_to_src[module_name] = {}
+            self._merge_sources(self.obj_to_src[module_name], obj_source)
+
+    def collect_modules(self, no_modules=False, modorder='modules.order'):
+        """
+        Collect source files for kernel modules
+        """
+        if no_modules:
+            return
+
+        self._load_module_list(modorder)
+        self._parse_module_objects()
+
+    # -------------------------------------------------------------------------
+    # Builtin Collection (RHEL version-specific)
+    # -------------------------------------------------------------------------
+
+    def _collect_builtin_rhel7(self):
+        """
+        Collect built-in objects for RHEL 7 using *built-in.o.cmd files
+        """
+        pattern = '*built-in.o.cmd'
+        cmd_list = {
+            strip_path_prefixes(path, self.build_dir)
+            for path in pathlib.Path(self.build_dir).rglob(pattern)
+        }
+
+        for entry in cmd_list:
+            sources = self._parse_a_cmd(entry)
+            self._merge_sources(self.obj_to_src[VMLINUX], sources)
+
+    def _collect_builtin_archive(self):
+        """
+        Collect built-in objects for RHEL 8/9 using *built-in.a archives
+        """
+        pattern = '*built-in.a'
+        archive_list = {
+            strip_path_prefixes(path, self.build_dir)
+            for path in pathlib.Path(self.build_dir).rglob(pattern)
+        }
+
+        for entry in archive_list:
+            path = os.path.join(self.build_dir, entry)
+            objects = subprocess.check_output(['ar', 't', path]).decode().split()
+
+            for obj in objects:
+                obj_path = strip_path_prefixes(obj, build_dir=self.build_dir)
+                sources = self._parse_o_cmd(obj_path)
+                self._merge_sources(self.obj_to_src[VMLINUX], sources)
+
+    def _collect_builtin_vmlinux_archive(self):
+        """
+        Collect built-in objects for upstream kernels using single vmlinux.a archive
+        """
+        path = os.path.join(self.build_dir, 'vmlinux.a')
+        objects = subprocess.check_output(['ar', 't', path]).decode().split()
+
+        for obj in objects:
+            obj_path = strip_path_prefixes(obj, build_dir=self.build_dir)
+            sources = self._parse_o_cmd(obj_path)
+            self._merge_sources(self.obj_to_src[VMLINUX], sources)
+
+    def collect_builtin(self, no_builtin=False):
+        """
+        Collect source files for vmlinux built-in objects
+
+        Uses RHEL version-specific collection method via dispatch table.
+        """
+        if VMLINUX not in self.obj_to_src:
+            self.obj_to_src[VMLINUX] = {}
+
+        if no_builtin:
+            return
+
+        collector_name = self.BUILTIN_COLLECTORS.get(self.rhel, '_collect_builtin_archive')
+        collector = getattr(self, collector_name)
+        collector()
+
+    # -------------------------------------------------------------------------
+    # Module-to-RPM Mapping
+    # -------------------------------------------------------------------------
+
+    def _parse_module_list_file(self, filename, rpm_name):
+        """
+        Parse a module list file and add entries to module_rpm mapping
+
+        Handles various formats:
+        - Absolute paths: /lib/modules/5.14.0/kernel/drivers/net/e1000.ko.xz
+        - Relative paths: kernel/drivers/net/e1000.ko
+        - Skips RPM spec directives (%dir, %defattr, etc.)
+
+        Args:
+            filename: Path to the module list file
+            rpm_name: Literal RPM package name (e.g., "kernel-modules-5.14.0.rpm")
+        """
+        if not filename or not os.path.exists(filename):
+            return
+
+        with open(filename, 'rt', encoding='utf-8') as f:
+            for line in f:
+                line = line.strip()
+
+                # Skip empty lines, comments, and RPM spec directives
+                if not line or line.startswith('#') or line.startswith('%'):
+                    continue
+
+                # Skip non-module files
+                if '.ko' not in line:
+                    continue
+
+                # Extract module name from path
+                module = os.path.basename(line)
+                # Remove .ko and any compression suffix
+                module = re.sub(r'\.ko(\.[^.]+)?$', '', module)
+
+                if not module:
+                    continue
+
+                if module not in self.module_rpm:
+                    self.module_rpm[module] = {}
+
+                if rpm_name not in self.module_rpm[module]:
+                    self.module_rpm[module][rpm_name] = []
+                if self.variant_idx not in self.module_rpm[module][rpm_name]:
+                    self.module_rpm[module][rpm_name].append(self.variant_idx)
+
+    def collect_module_rpm(self, module_lists, vmlinux_rpm=''):
+        """
+        Collect module-to-RPM name mappings from module list files
+
+        Args:
+            module_lists: List of "rpm_name:path" strings
+            vmlinux_rpm: RPM package name for vmlinux
+        """
+        if not module_lists and not vmlinux_rpm:
+            return
+
+        # Add vmlinux to specified RPM
+        if vmlinux_rpm:
+            if VMLINUX not in self.module_rpm:
+                self.module_rpm[VMLINUX] = {}
+            if vmlinux_rpm not in self.module_rpm[VMLINUX]:
+                self.module_rpm[VMLINUX][vmlinux_rpm] = []
+            if self.variant_idx not in self.module_rpm[VMLINUX][vmlinux_rpm]:
+                self.module_rpm[VMLINUX][vmlinux_rpm].append(self.variant_idx)
+
+        # Process module list files
+        for entry in module_lists:
+            if ':' not in entry:
+                print(f'Warning: Invalid --module-list format "{entry}", expected RPM:PATH')
+                continue
+
+            rpm_name, path = entry.split(':', 1)
+            self._parse_module_list_file(path, rpm_name)
+
+    # -------------------------------------------------------------------------
+    # Output
+    # -------------------------------------------------------------------------
+
+    def _build_reverse_map(self):
+        """
+        Create reverse mapping (source -> {obj: [indices]}) from obj_to_src
+        """
+        for obj, sources in self.obj_to_src.items():
+            for source, indices in sources.items():
+                if source not in self.src_to_obj:
+                    self.src_to_obj[source] = {}
+                if obj not in self.src_to_obj[source]:
+                    self.src_to_obj[source][obj] = []
+                for idx in indices:
+                    if idx not in self.src_to_obj[source][obj]:
+                        self.src_to_obj[source][obj].append(idx)
+
+    def _build_rpm_reverse_map(self):
+        """
+        Create reverse mapping (rpm -> {module: [indices]}) from module_rpm
+        """
+        for module, rpms in self.module_rpm.items():
+            for rpm, indices in rpms.items():
+                if rpm not in self.rpm_to_modules:
+                    self.rpm_to_modules[rpm] = {}
+                if module not in self.rpm_to_modules[rpm]:
+                    self.rpm_to_modules[rpm][module] = []
+                for idx in indices:
+                    if idx not in self.rpm_to_modules[rpm][module]:
+                        self.rpm_to_modules[rpm][module].append(idx)
+
+    def save_data(self):
+        """
+        Save collected data to JSON file
+
+        Output structure:
+          - variants: list of variant names
+          - source-map: source file mappings
+            - obj-src: object/module -> {source: [variant_indices]}
+            - src-obj: source -> {object/module: [variant_indices]}
+          - module-map: module to RPM mappings
+            - module-rpm: module name -> {rpm-name: [variant_indices]}
+            - rpm-modules: rpm-name -> {module name: [variant_indices]}
+
+        Variant indices correspond to positions in the 'variants' list.
+        """
+        output = {
+            'variants': self.variants,
+            'source-map': {
+                'obj-src': self.obj_to_src,
+                'src-obj': self.src_to_obj
+            },
+            'module-map': {
+                'module-rpm': self.module_rpm,
+                'rpm-modules': self.rpm_to_modules
+            }
+        }
+
+        filename = self.outprefix + 'kernel-map.json'
+        with open(os.path.join(self.output_dir, filename), 'wt', encoding='utf-8') as f:
+            json.dump(output, f, indent=2, sort_keys=True)
+
+    # -------------------------------------------------------------------------
+    # Main Entry Point
+    # -------------------------------------------------------------------------
+
+    def collect_data(self, no_modules=False, no_builtin=False, modorder='modules.order',
+                     input_file='', module_lists=None, vmlinux_rpm=''):
+        """
+        Main entry point - collect all data and save to JSON
+        """
+        self.load_existing(input_file)
+        self.add_variant()
+        self.collect_modules(no_modules, modorder)
+        self.collect_builtin(no_builtin)
+        self.collect_module_rpm(module_lists or [], vmlinux_rpm)
+        self._build_reverse_map()
+        self._build_rpm_reverse_map()
+        self.save_data()
+
+
+# =============================================================================
+# Main
+# =============================================================================
+
+def main():
+    """
+    Main entry point
+    """
+    args = parse_args()
+
+    start = time.monotonic()
+
+    source_map = SourceMap(
+            build_dir=args.directory,
+            output_dir=args.outputdir,
+            outprefix=args.prefix,
+            rhel=args.rhel,
+            variant=args.variant)
+
+    source_map.collect_data(
+            no_modules=args.no_modules,
+            no_builtin=args.no_builtin,
+            input_file=args.input,
+            module_lists=args.module_list,
+            vmlinux_rpm=args.vmlinux_rpm)
+
+    if args.time:
+        elapsed = time.monotonic() - start
+        minutes, seconds = divmod(int(elapsed), 60)
+        print(f'Elapsed time: {minutes:02d}:{seconds:02d}')
+
+
+if __name__ == '__main__':
+    main()
--- a/6
+++ b/6
@ -1,3 +1,3 @@
-SHA512 (linux-5.14.0-731.el9.tar.xz) = eb77d7c84d26cc0dfd34de1e44c960e3c08d9d7515279c6db5c6949415717734d732d2dfbccb75ccef3b75147fb83e06a018e78b243ccfbed41977d875ce1d8c
-SHA512 (kernel-abi-stablelists-5.14.0-731.el9.tar.bz2) = 920bf9507f67e9523dfa2bda7de756451aabbb9e6cc8e6488bfe25576cfb09f5040e0712988539eae74c111fd6a75b98f9fc67a9122b0b6a3cb02e7036c8ab5c
-SHA512 (kernel-kabi-dw-5.14.0-731.el9.tar.bz2) = cedc95c509a24a74f0237852c0749ea590d98bb4996c8e406555e001e4db7489b876bb186b5335f5b54627ddd98c0f3e3791073b848231afe3651fbcff8f3ae9
+SHA512 (linux-5.14.0-732.el9.tar.xz) = 78eaaafe61902c319003b347143670dbdb618404bed26f9961dd6909fc33688551086e33373a88be74d9cadb4f81335c5c001fb4a3d60781bbb18b3cc38c6484
+SHA512 (kernel-abi-stablelists-5.14.0-732.el9.tar.bz2) = 871e039e2bdee93fddd66bd59cb5b4c676903fd4b4c3b479dc3ed22ea12fa2cd783100189efe0e8529cd26b3a9f9d7366e751964ef9ff2af78639ed67985cc71
+SHA512 (kernel-kabi-dw-5.14.0-732.el9.tar.bz2) = 5f50a57755cc31acf98e1e47158b24458c9fb4aacf58cf8457697b0b7f0efbcb1f9c448a40e6f9ab9bd3e7d059a8d5a5403a16aad4a62536202a480db90975b1