From 212dc7242a4598a9cb869f45644e03fc7d498664 Mon Sep 17 00:00:00 2001 From: CKI KWF Bot Date: Tue, 4 Aug 2026 08:25:47 +0000 Subject: [PATCH] kernel-5.14.0-732.el9 * Tue Aug 04 2026 CKI KWF Bot [5.14.0-732.el9] - crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738] - xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340] - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116} - espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239} - xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797} - xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797} - redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547] - redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) - gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801] - gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801] - gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801] - gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801] - gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801] - gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801] - gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801] - timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214} - gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745] - scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832] - blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} - blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} - cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691] - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684] - watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487] - watchdog: set cdev owner before adding (David Arcari) [RHEL-192487] - watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487] - kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487] - usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798] - usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798] - usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798] - usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109} - usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759} - USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798] - usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798] - usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798] - USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798] - dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798] - dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798] - usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798] - usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798] - usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798] - cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729} - usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758} - USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798] - USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798] - USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798] - USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798] - usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798] - usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798] - usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488} - usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432} - usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427} - usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798] - usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798] - usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798] - USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428} - USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429} - USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798] - usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798] - thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798] - qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798] - usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798] - net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798] - usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425} - usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798] - USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798] - usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170} - phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798] - usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798] - genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798] - USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798] - usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798] - usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798] - usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798] - usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798] - usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798] - usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798] - usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798] - usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798] - usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798] - tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798] - xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259} - phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798] - net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798] - net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798] - bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798] - net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798] - pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798] - pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798] - usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798] - dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798] - usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798] - usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798] - usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798] - usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798] - usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798] - USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798] - usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798] - usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798] - usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798] - PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798] - PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798] - USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798] - USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798] - USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798] - thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798] - phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798] - phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798] - docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798] - phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798] - phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798] - usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798] - usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798] - dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798] - usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798] - usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798] - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359} - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113} - nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643] - nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643] - nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643] - nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] - nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643] - nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643] - nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643] - nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643] - nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643] - nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] - nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643] - Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201] - Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201] - Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201] - Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201] - Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201] - Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201] - Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201] - Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201] - Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201] - Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201] - Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201] - Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201] - Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201] - Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201] - Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201] - Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201] - Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201] - Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201] - Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201] - Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201] - Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201] - Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201] - Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201] - Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201] - Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201] - Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201] - Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201] - Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201] - Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201] - dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749] - dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749] - dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749] - dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749] - dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] - dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749] - dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] - dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749] - dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749] - dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749] - dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749] - dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749] - dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749] - ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450] - ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450] - ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450] - ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450] - ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450] - ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450] - ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450] - ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450] - ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450] - ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450] - ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450] - ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450] - ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450] - ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450] - ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450] - ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450] - ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450] - ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450] - ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007} - ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008} - ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450] - ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450] - ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009} - ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162} - ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450] - ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450] - ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450] - ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346} - drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450] - ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389} - ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450] - ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450] - ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450] - ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450] - ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450] - ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450] - ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450] - ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450] - ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450] - ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450] - ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450] - ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450] - ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450] - ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450] - Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450] - ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211} - net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694] - net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694] - net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694] - net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694] - net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694] - tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694] - tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240} - tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694] - tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694] - tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694] - net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694] - tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149} - ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694] - net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925] - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323} - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300} - i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251] - i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251] - i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251] - i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251] - ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601] - ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601] - netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601] - netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601] - netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601] - netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601] - neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981} - netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601] - netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601] - netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601] - netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601] - netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601] - netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601] - netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601] - netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601] - netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601] - netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601] - netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601] - netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601] - netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601] - netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601] - netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601] - netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496} - netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601] - netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601] - netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601] - netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601] - netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601] - netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601] - ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270} - netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601] - netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134} - netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218} - netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942} - netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219} - netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601] - netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220} - netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267} - netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212} - netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268} - netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269} - netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601] - netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601] - netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601] - netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912} - netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601] - netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915} - netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601] - netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970} - netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601] - netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601] - netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601] - netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601] - netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601] - netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601] - netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601] - netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986} - netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920} - netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324} - netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601] - netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998} - netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999} - netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001} - netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002} - netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841} - netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601] - netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131} - netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665} - netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681} - netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085} - netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024} - netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424} - netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418} - netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025} - netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026} - netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601] - netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028} - netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416} - netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601] - netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601] - netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414} - netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601] - netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674} - selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278} - netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351} - netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385} - netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601] - netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206} - netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206} - selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601] - netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601] - selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601] - netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655} - netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601] - netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201} - netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162} - netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601] - netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601] - netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601] - net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267] - octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043] - octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043] - net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043] - KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881] - KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881] - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117} - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145} - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669} - tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706] - tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706] - tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706] - tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706] - tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706] - tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706] - tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706] - sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695] - sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695] - sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695] - sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695] - sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695] - sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695] - sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695] - sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695] - net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695] - sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695] - net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695] - scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105} - scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217] - scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217] - scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473} - scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218] - scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218] Resolves: RHEL-113832, RHEL-141217, RHEL-141218, RHEL-147798, RHEL-152694, RHEL-152695, RHEL-152706, RHEL-154836, RHEL-154906, RHEL-168738, RHEL-171507, RHEL-174251, RHEL-176061, RHEL-177450, RHEL-177879, RHEL-178340, RHEL-178626, RHEL-180034, RHEL-180088, RHEL-180161, RHEL-180173, RHEL-180269, RHEL-182043, RHEL-183881, RHEL-184267, RHEL-186601, RHEL-186696, RHEL-189902, RHEL-189938, RHEL-189941, RHEL-190801, RHEL-192402, RHEL-192487, RHEL-192925, RHEL-193749, RHEL-194201, RHEL-210643, RHEL-212684, RHEL-212691, RHEL-213155, RHEL-213547, RHEL-213745 Signed-off-by: CKI KWF Bot --- Makefile.rhelver | 2 +- kernel.changelog | 497 +++++++++++++++++++++++++++ kernel.spec | 613 ++++++++++++++++++++++++++++++++- kmap.py | 874 +++++++++++++++++++++++++++++++++++++++++++++++ sources | 6 +- 5 files changed, 1981 insertions(+), 11 deletions(-) create mode 100755 kmap.py diff --git a/Makefile.rhelver b/Makefile.rhelver index c776d9dfa..3b003dd4b 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 9 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 731 +RHEL_RELEASE = 732 # # ZSTREAM diff --git a/kernel.changelog b/kernel.changelog index 62ec30b85..0e36bbeb1 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,500 @@ +* Tue Aug 04 2026 CKI KWF Bot [5.14.0-732.el9] +- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738] +- xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340] +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116} +- espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239} +- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797} +- xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797} +- redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547] +- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) +- gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801] +- timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214} +- gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745] +- scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832] +- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} +- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} +- cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684] +- watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487] +- watchdog: set cdev owner before adding (David Arcari) [RHEL-192487] +- watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487] +- kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487] +- usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798] +- usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798] +- usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798] +- usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109} +- usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759} +- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798] +- usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798] +- usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798] +- dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798] +- dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798] +- usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798] +- usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798] +- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798] +- cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729} +- usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758} +- USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798] +- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798] +- usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798] +- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798] +- usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488} +- usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432} +- usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427} +- usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798] +- usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798] +- usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798] +- USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428} +- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429} +- USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798] +- usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798] +- thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798] +- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798] +- usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798] +- net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798] +- usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425} +- usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798] +- USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798] +- usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170} +- phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798] +- usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798] +- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798] +- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798] +- usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798] +- usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798] +- usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798] +- usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798] +- usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798] +- tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259} +- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798] +- net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798] +- net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798] +- bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798] +- net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798] +- pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798] +- pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798] +- usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798] +- dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798] +- usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798] +- usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798] +- USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798] +- usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798] +- usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798] +- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798] +- PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798] +- USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798] +- USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798] +- USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798] +- thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798] +- phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798] +- phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798] +- docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798] +- phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798] +- usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798] +- dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798] +- usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798] +- usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798] +- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359} +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113} +- nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643] +- nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643] +- nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643] +- nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] +- nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643] +- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643] +- nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643] +- nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643] +- nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643] +- nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] +- nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643] +- Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201] +- Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201] +- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201] +- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201] +- Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201] +- Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201] +- Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201] +- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201] +- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201] +- Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201] +- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201] +- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201] +- Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201] +- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201] +- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201] +- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201] +- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201] +- Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201] +- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201] +- Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201] +- Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201] +- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201] +- Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201] +- dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749] +- dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749] +- dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749] +- dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749] +- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] +- dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749] +- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] +- dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749] +- dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749] +- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749] +- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749] +- dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749] +- ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450] +- ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450] +- ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450] +- ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450] +- ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450] +- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450] +- ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450] +- ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450] +- ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450] +- ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450] +- ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450] +- ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450] +- ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450] +- ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450] +- ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450] +- ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450] +- ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450] +- ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450] +- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007} +- ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008} +- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450] +- ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450] +- ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009} +- ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162} +- ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450] +- ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450] +- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450] +- ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346} +- drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450] +- ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389} +- ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450] +- ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450] +- ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450] +- ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450] +- ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450] +- ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450] +- ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450] +- ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450] +- ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450] +- ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450] +- ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450] +- ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450] +- ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450] +- ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450] +- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450] +- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211} +- net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694] +- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694] +- tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694] +- tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240} +- tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694] +- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694] +- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694] +- net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694] +- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149} +- ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694] +- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925] +- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323} +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} +- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} +- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300} +- i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251] +- i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251] +- i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251] +- i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251] +- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601] +- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601] +- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601] +- netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601] +- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601] +- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601] +- neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981} +- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601] +- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601] +- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601] +- netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601] +- netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601] +- netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601] +- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601] +- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601] +- netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601] +- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496} +- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601] +- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601] +- ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270} +- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601] +- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134} +- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218} +- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942} +- netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219} +- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601] +- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220} +- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267} +- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212} +- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268} +- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269} +- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601] +- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601] +- netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912} +- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601] +- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915} +- netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970} +- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601] +- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601] +- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601] +- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601] +- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601] +- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601] +- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986} +- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920} +- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324} +- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601] +- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998} +- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999} +- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001} +- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002} +- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841} +- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601] +- netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131} +- netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665} +- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681} +- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085} +- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024} +- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424} +- netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418} +- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025} +- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026} +- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601] +- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028} +- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416} +- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601] +- netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414} +- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601] +- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674} +- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278} +- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351} +- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385} +- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206} +- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206} +- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601] +- netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655} +- netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601] +- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201} +- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162} +- netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601] +- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267] +- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043] +- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043] +- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881] +- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881] +- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} +- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} +- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117} +- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145} +- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669} +- tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706] +- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706] +- tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706] +- tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706] +- tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706] +- tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706] +- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706] +- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695] +- sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695] +- sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695] +- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695] +- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695] +- sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695] +- sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695] +- sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695] +- net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695] +- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695] +- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695] +- scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105} +- scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217] +- scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473} +- scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218] +Resolves: RHEL-113832, RHEL-141217, RHEL-141218, RHEL-147798, RHEL-152694, RHEL-152695, RHEL-152706, RHEL-154836, RHEL-154906, RHEL-168738, RHEL-171507, RHEL-174251, RHEL-176061, RHEL-177450, RHEL-177879, RHEL-178340, RHEL-178626, RHEL-180034, RHEL-180088, RHEL-180161, RHEL-180173, RHEL-180269, RHEL-182043, RHEL-183881, RHEL-184267, RHEL-186601, RHEL-186696, RHEL-189902, RHEL-189938, RHEL-189941, RHEL-190801, RHEL-192402, RHEL-192487, RHEL-192925, RHEL-193749, RHEL-194201, RHEL-210643, RHEL-212684, RHEL-212691, RHEL-213155, RHEL-213547, RHEL-213745 + * Wed Jul 29 2026 CKI KWF Bot [5.14.0-731.el9] - crypto: rng - Enable pre-emption ASAP (Herbert Xu) [RHEL-92680] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213301] {CVE-2026-64530} diff --git a/kernel.spec b/kernel.spec index 665dcc754..197876d58 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,15 +176,15 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 731 +%define pkgrelease 732 %define kversion 5 -%define tarfile_release 5.14.0-731.el9 +%define tarfile_release 5.14.0-732.el9 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 731%{?buildid}%{?dist} +%define specrelease 732%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-731.el9 +%define kabiversion 5.14.0-732.el9 # # End of genspec.sh variables @@ -225,6 +225,8 @@ Summary: The Linux kernel %define with_tools %{?_without_tools: 0} %{?!_without_tools: 1} # kernel-debuginfo %define with_debuginfo %{?_without_debuginfo: 0} %{?!_without_debuginfo: 1} +# kernel-kmap-internal: source-to-module mapping data (JSON) +%define with_kmap %{?_without_kmap: 0} %{?!_without_kmap: 1} # kernel-abi-stablelists %define with_kernel_abi_stablelists %{?_without_kernel_abi_stablelists: 0} %{?!_without_kernel_abi_stablelists: 1} # internal samples and selftests @@ -568,6 +570,10 @@ Summary: The Linux kernel %define _enable_debug_packages 0 %endif +%ifnarch x86_64 ppc64le s390x aarch64 +%define with_kmap 0 +%endif + # Architectures we build tools/cpupower on %if 0%{?fedora} %define cpupowerarchs %{ix86} x86_64 ppc64le %{arm} aarch64 @@ -598,6 +604,13 @@ Summary: The Linux kernel %define with_debug 0 %endif +# Define with_base to indicate if any non-debug variant is being built. +# Used to conditionally build packages that only make sense for base variants. +%if %{with_zfcpdump} || %{with_pae} || %{with_up} || %{with_arm64_64k} || %{with_realtime} || %{with_realtime_arm64_64k} +%define with_base 1 +%else +%define with_base 0 +%endif # # Packages that need to be installed before the kernel is, because the %%post @@ -941,6 +954,9 @@ Source2000: cpupower.service Source2001: cpupower.config Source2002: kvm_stat.logrotate +# Sources for kernel-kmap-internal +Source2100: kmap.py + # Some people enjoy building customized kernels from the dist-git in Fedora and # use this to override configuration options. One day they may all use the # source tree, but in the mean time we carry this to support the legacy workflow @@ -1217,6 +1233,27 @@ This package provides debug information for the rv package. # with_tools %endif +%if %{with_kmap} && %{with_base} +%package -n %{name}-kmap-internal +Summary: Kernel source-to-module mapping data and module list +Group: Development/System +BuildRequires: python3 +%description -n %{name}-kmap-internal +The %{name}-kmap-internal package contains a JSON mapping file that describes +which C source files contributed to each kernel module and to the built-in +vmlinux image, and which RPM package each module is shipped in. + +Files installed under /usr/share/%{name}-kmap-internal/: + kernel-map-.json - unified mapping file for all kernel variants containing: + - variants: list of variant names (e.g., ["stock", "rt"]) + - source-map: source file mappings + - obj-src: maps kernel objects to source files with variant indices + - src-obj: maps source files to kernel objects with variant indices + - module-map: module to RPM mappings + - module-rpm: maps module names to RPM package names with variant indices + - rpm-modules: maps RPM package names to module names with variant indices +%endif + %if %{with_selftests} %package selftests-internal @@ -2603,6 +2640,44 @@ BuildKernel() { %if %{with_gcov} popd %endif + +%if %{with_kmap} && %{with_base} + # Generate source-to-module mapping data using kmap.py. + # Must run before the next BuildKernel call issues make mrproper, which + # would wipe the .cmd files that kmap.py reads. Skip debug variants + # (same source mapping as the base kernel). + if [[ "$Variant" != *debug* ]]; then + _kmap_bdir=$(pwd) + _kmap_basedir=%{_builddir}/kmap-data + _kmap_merged=$_kmap_basedir/kernel-map.json + _kmap_variant=${Variant:-stock} + _kmap_listprefix=../kernel${Variant:+-${Variant}} + mkdir -p $_kmap_basedir + + # Build kmap.py arguments; merge with existing data if present + _kmap_args="--directory $_kmap_bdir --outputdir $_kmap_basedir --rhel 9 --variant $_kmap_variant --time" + _kmap_args="$_kmap_args --vmlinux-rpm %{name}-core-%{KVERREL}.rpm" + if [ -f "$_kmap_merged" ]; then + _kmap_args="$_kmap_args --input kernel-map.json" + fi + + # Add module list files for module-to-RPM mapping + for _kmap_type in modules-core modules modules-extra modules-internal; do + if [ -f "${_kmap_listprefix}-${_kmap_type}.list" ]; then + _kmap_rpm=%{name}-${_kmap_type}-%{KVERREL}.rpm + _kmap_args="$_kmap_args --module-list ${_kmap_rpm}:${_kmap_listprefix}-${_kmap_type}.list" + fi + done +%if 0%{!?fedora:1} + if [ -f "${_kmap_listprefix}-modules-partner.list" ]; then + _kmap_rpm=%{name}-modules-partner-%{KVERREL}.rpm + _kmap_args="$_kmap_args --module-list ${_kmap_rpm}:${_kmap_listprefix}-modules-partner.list" + fi +%endif + + python3 %{SOURCE2100} $_kmap_args + fi +%endif } ### @@ -2770,9 +2845,15 @@ for dir in bpf bpf/no_alu32 bpf/cpuv4 bpf/progs; do # other issues. If something did not get built, just skip it. test -d $dir || continue mkdir -p %{buildroot}%{_libexecdir}/kselftests/$dir - find $dir -maxdepth 1 -type f \( -executable -o -name '*.py' -o -name settings -o \ - -name 'btf_dump_test_case_*.c' -o -name '*.ko' -o \ - -name '*.o' -exec sh -c 'readelf -h "{}" | grep -q "^ Machine:.*BPF"' \; \) -print0 | \ + find $dir -maxdepth 1 -type f \( \ + -executable -o \ + -name '*.py' -o \ + -name settings -o \ + -name DENYLIST -o \ + -name 'btf_dump_test_case_*.c' -o \ + -name '*.ko' -o \ + -name '*.o' -exec sh -c 'readelf -h "{}" | grep -q "^ Machine:.*BPF"' \; \ + \) -print0 | \ xargs -0 cp -t %{buildroot}%{_libexecdir}/kselftests/$dir || true done ln -sr %{buildroot}%{_libexecdir}/kselftests/bpf/bpftool %{buildroot}%{_libexecdir}/kselftests/bpf/no_alu32/bpftool @@ -2783,6 +2864,13 @@ ln -sr %{buildroot}%{_libexecdir}/kselftests/bpf/bpftool %{buildroot}%{_libexec %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs" %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-no_alu32" %buildroot_save_unstripped "usr/libexec/kselftests/bpf/test_progs-cpuv4" + +# Append RHEL-specific BPF selftests DENYLIST.rhel to the global DENYLIST that +# is automatically picked by BPF selftest runners. +%if 0%{?rhel}%{?centos} + cat ./bpf/DENYLIST.rhel >> %{buildroot}%{_libexecdir}/kselftests/bpf/DENYLIST +%endif + popd %endif @@ -3170,6 +3258,14 @@ find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/ popd %endif +%if %{with_kmap} && %{with_base} +# Install kmap data files produced during %build. +_kmap_basedir=%{_builddir}/kmap-data +_kmap_destbase=$RPM_BUILD_ROOT%{_datadir}/%{name}-kmap-internal +mkdir -p $_kmap_destbase +install -m 644 $_kmap_basedir/kernel-map.json $_kmap_destbase/kernel-map-%{KVERREL}.json +%endif + ### ### clean ### @@ -3601,6 +3697,13 @@ fi %{_libexecdir}/kselftests %endif +%if %{with_kmap} && %{with_base} +%files -n %{name}-kmap-internal +%defattr(-,root,root) +%dir %{_datadir}/%{name}-kmap-internal +%{_datadir}/%{name}-kmap-internal/kernel-map-%{KVERREL}.json +%endif + # empty meta-package %if %{with_up} %ifnarch %nobuildarches noarch @@ -3753,6 +3856,502 @@ fi # # %changelog +* Tue Aug 04 2026 CKI KWF Bot [5.14.0-732.el9] +- crypto: tegra - fix rctx->cryptlen calculation in tegra_gcm_do_one_req() (CKI Backport Bot) [RHEL-168738] +- xfrm: esp: restore combined single-frag length gate (Xin Long) [RHEL-178340] +- xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Xin Long) [RHEL-180173] {CVE-2026-46116} +- espintcp: Fix race condition in espintcp_close() (Xin Long) [RHEL-154906] {CVE-2026-23239} +- xfrm: xfrm_alloc_spi shouldn't use 0 as SPI (Xin Long) [RHEL-180034] {CVE-2025-39797} +- xfrm: Duplicate SPI Handling (Xin Long) [RHEL-180034] {CVE-2025-39797} +- redhat: Add DENYLIST.rhel to BPF selftests (Veronika Molnarova) [RHEL-213547] +- redhat: add kmap.py tool and kernel-kmap-internal package (Rado Vrbovsky) +- gfs2: Remove the glock lru list and shrinker (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Skip dlm unlocks earlier (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Don't cache unreferenced glocks (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Enable automatic glock hash table shrinking (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Introduce glock_{type,number,sbd} helpers (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Minor gfs2_glock_cb cleanup (Andreas Gruenbacher) [RHEL-190801] +- gfs2: Clean up glock demote logic (Andreas Gruenbacher) [RHEL-190801] +- timers: Fix NULL function pointer race in timer_shutdown_sync() (Waiman Long) [RHEL-189941] {CVE-2025-68214} +- gfs2: page poisoning fix (CKI Backport Bot) [RHEL-213745] +- scsi: core: wake eh reliably when using scsi_schedule_eh (David Jeffery) [RHEL-113832] +- blk-mq: reinsert cached request to the list (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} +- blk-mq: pop cached request if it is usable (CKI Backport Bot) [RHEL-213155] {CVE-2026-64017} +- cpufreq: intel_pstate: Set non-turbo capacity to HWP_GUARANTEED_PERF() (David Arcari) [RHEL-212691] +- can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212684] +- watchdog: Fix kmemleak in watchdog_cdev_register (David Arcari) [RHEL-192487] +- watchdog: set cdev owner before adding (David Arcari) [RHEL-192487] +- watchdog: fix watchdog may detect false positive of softlockup (David Arcari) [RHEL-192487] +- kernel/watchdog: always restore watchdog_softlockup(,hardlockup)_user_enabled after proc show (David Arcari) [RHEL-192487] +- usb: typec: ucsi: skip connector validation before init (Desnes Nunes) [RHEL-147798] +- usb: host: xhci-sideband: delegate offload_usage tracking to class drivers (Desnes Nunes) [RHEL-147798] +- usb: core: use dedicated spinlock for offload state (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: fix memory leak on probe failure path (Desnes Nunes) [RHEL-147798] +- usb: ulpi: fix memory leak on ulpi_register() error paths (Desnes Nunes) [RHEL-147798] {CVE-2026-46109} +- usb: ulpi: fix double free in ulpi_register_interface() error path (Desnes Nunes) [RHEL-147798] {CVE-2026-31759} +- USB: core: add NO_LPM quirk for Razer Kiyo Pro webcam (Desnes Nunes) [RHEL-147798] +- usb: add quirks for Lenovo OneLink+ Dock (Desnes Nunes) [RHEL-147798] +- usb: core: phy: avoid double use of 'usb3-phy' (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add MeiG Smart SRM825WN (Desnes Nunes) [RHEL-147798] +- dt-bindings: connector: add pd-disable dependency (Desnes Nunes) [RHEL-147798] +- dt-bindings: Drop remaining unneeded quotes (Desnes Nunes) [RHEL-147798] +- usb: typec: thunderbolt: Set enter_vdo during initialization (Desnes Nunes) [RHEL-147798] +- usb: typec: Remove alt->adev.dev.class assignment (Desnes Nunes) [RHEL-147798] +- usb: quirks: add DELAY_INIT quirk for another Silicon Motion flash drive (Desnes Nunes) [RHEL-147798] +- cdc-acm: new quirk for EPSON HMD (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: validate connector number in ucsi_notify_common() (Desnes Nunes) [RHEL-147798] {CVE-2026-31729} +- usb: usbtmc: Flush anchored URBs in usbtmc_release (Desnes Nunes) [RHEL-147798] {CVE-2026-31758} +- USB: serial: io_edgeport: add support for Blackbox IC135A (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add missing RSVD(5) flag for Rolling RW135R-GL (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add support for Rolling Wireless RW135R-GL (Desnes Nunes) [RHEL-147798] +- USB: ezcap401 needs USB_QUIRK_NO_BOS to function on 10gbs usb speed (Desnes Nunes) [RHEL-147798] +- usb: typec: altmode/displayport: set displayport signaling rate in configure message (Desnes Nunes) [RHEL-147798] +- usb/core/quirks: Add Huawei ME906S-device to wakeup quirk (Desnes Nunes) [RHEL-147798] +- usb: xhci: Prevent interrupt storm on host controller error (HCE) (Desnes Nunes) [RHEL-147798] {CVE-2026-43488} +- usb: xhci: Fix memory leak in xhci_disable_slot() (Desnes Nunes) [RHEL-147798] {CVE-2026-43432} +- usb: class: cdc-wdm: fix reordering issue in read code path (Desnes Nunes) [RHEL-147798] {CVE-2026-43427} +- usb: cdc-acm: Restore CAP_BRK functionnality to CH343 (Desnes Nunes) [RHEL-147798] +- usb: core: new quirk to handle devices with zero configurations (Desnes Nunes) [RHEL-147798] +- usb: misc: uss720: properly clean up reference in uss720_probe() (Desnes Nunes) [RHEL-147798] +- USB: core: Limit the length of unkillable synchronous timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43428} +- USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts (Desnes Nunes) [RHEL-147798] {CVE-2026-43429} +- USB: usbcore: Introduce usb_bulk_msg_killable() (Desnes Nunes) [RHEL-147798] +- usb: core: don't power off roothub PHYs if phy_set_mode() fails (Desnes Nunes) [RHEL-147798] +- thunderbolt: Fix property read in nhi_wake_supported() (Desnes Nunes) [RHEL-147798] +- qmi_wwan: allow max_mtu above hard_mtu to control rx_urb_size (Desnes Nunes) [RHEL-147798] +- usbnet: limit max_mtu based on device's hard_mtu (Desnes Nunes) [RHEL-147798] +- net: usb: r8152: add TRENDnet TUC-ET2G (Desnes Nunes) [RHEL-147798] +- usb: image: mdc800: kill download URB on timeout (Desnes Nunes) [RHEL-147798] {CVE-2026-43425} +- usb: mdc800: handle signal and read racing (Desnes Nunes) [RHEL-147798] +- USB: add QUIRK_NO_BOS for video capture several devices (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: Add Thunderbolt alternate mode support (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: parametrize PORTSC1 register offset (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: parametrize HSIC PTS value (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: return error value from utmi_wait_register (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: cosmetic fixes (Desnes Nunes) [RHEL-147798] +- usb: dwc3: gadget: Move vbus draw to workqueue context (Desnes Nunes) [RHEL-147798] {CVE-2026-43170} +- phy: tegra: xusb: Remove unused powered_on variable (Desnes Nunes) [RHEL-147798] +- usb: typec: fusb302: Remove IRQF_ONESHOT (Desnes Nunes) [RHEL-147798] +- genirq: Set IRQF_COND_ONESHOT in devm_request_irq(). (Desnes Nunes) [RHEL-147798] +- USB: serial: option: add Telit FN920C04 RNDIS compositions (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Log dwc3 address in traces (Desnes Nunes) [RHEL-147798] +- usb: gadget: tegra-xudc: Add handling for BLCG_COREPLL_PWRDN (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: add HSIC support (Desnes Nunes) [RHEL-147798] +- usb: phy: tegra: use phy type directly (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: Support mode selection to activate altmodes (Desnes Nunes) [RHEL-147798] +- usb: typec: Introduce mode_selection bit (Desnes Nunes) [RHEL-147798] +- usb: typec: Implement mode selection (Desnes Nunes) [RHEL-147798] +- usb: typec: Expose alternate mode priority via sysfs (Desnes Nunes) [RHEL-147798] +- usb: typec: Add mode_control field to port property (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to device property API (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to dev_err_probe() (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Convert to devm_clk_get_optional() (Desnes Nunes) [RHEL-147798] +- usb: phy: generic: Always use dev in usb_phy_generic_probe() (Desnes Nunes) [RHEL-147798] +- usbip: Reduce CONNRESET message noise in dmesg from stub (Desnes Nunes) [RHEL-147798] +- tools: usb: usbip: remove dead-link from README (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting manufacturer string through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting product string through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: allow setting device serial number through sysfs (Desnes Nunes) [RHEL-147798] +- xhci: dbc: prepare to expose strings through sysfs (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: enable RX Termination override (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: set platform driver data (Desnes Nunes) [RHEL-147798] {CVE-2026-43259} +- phy: fsl-imx8mq-usb: disable bind/unbind platform driver feature (Desnes Nunes) [RHEL-147798] +- net: ethtool: Add support for 80Gbps speed (Desnes Nunes) [RHEL-147798] +- net: thunderbolt: Allow reading link settings (Desnes Nunes) [RHEL-147798] +- bonding: 3ad: Add support for SPEED_80000 (Desnes Nunes) [RHEL-147798] +- net: thunderbolt: Allow changing MAC address of the device (Desnes Nunes) [RHEL-147798] +- pinctrl: tegra-xusb: Simplify locking with guard() (Desnes Nunes) [RHEL-147798] +- pinctrl: tegra-xusb: Return void in padctl enable/disable functions (Desnes Nunes) [RHEL-147798] +- usb: misc: onboard_dev: Add WCH CH334 USB2.0 Hub (1a86:8091) (Desnes Nunes) [RHEL-147798] +- dt-bindings: usb: Add binding for WCH CH334/CH335 hub controller (Desnes Nunes) [RHEL-147798] +- usb: dwc3: fix dwc3_readl() and dwc3_writel() calls in dwc3_ulpi_setup() (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Support USB3340x ULPI PHY high-speed negotiation. (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Add dwc pointer to dwc3_readl/writel (Desnes Nunes) [RHEL-147798] +- usb: dwc3: Remove of dep->regs (Desnes Nunes) [RHEL-147798] +- usb: chipidea: ci_hdrc_imx: use "wakeup" suffix for wakeup interrupt name (Desnes Nunes) [RHEL-147798] +- USB: HCD: remove logic about which hcd is loaded (Desnes Nunes) [RHEL-147798] +- usb: isp1362-hcd: remove Philips ISP1362 USB OTG controller driver (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: disable auto suspend for host role (Desnes Nunes) [RHEL-147798] +- usb: dwc3: imx8mp: rename dwc3 to dwc3_pdev in struct dwc3_imx8mp (Desnes Nunes) [RHEL-147798] +- usb: dwc3: drd: extend dwc3_pre_set_role() to extcon and otg usecase (Desnes Nunes) [RHEL-147798] +- PCI: Add PCI_BRIDGE_NO_ALIAS quirk for ASPEED AST1150 (Desnes Nunes) [RHEL-147798] +- PCI: Add ASPEED vendor ID to pci_ids.h (Desnes Nunes) [RHEL-147798] +- USB: core: Discard pm_runtime_put() return value (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: drop an unused Kconfig symbol (Desnes Nunes) [RHEL-147798] +- USB: host: drop unneeded dependency on OF_GPIO (Desnes Nunes) [RHEL-147798] +- USB: typec: tcpm: Fix a typo (Desnes Nunes) [RHEL-147798] +- thunderbolt: Log path activation failures without WARN backtraces (Desnes Nunes) [RHEL-147798] +- phy: core: Simplify with scoped for each OF child loop (Desnes Nunes) [RHEL-147798] +- phy: core: Reinstate pm_runtime_enabled() check in phy_pm_runtime_put() (Desnes Nunes) [RHEL-147798] +- docs: admin-guide: thunderbolt: Replace ifconfig with ip (Desnes Nunes) [RHEL-147798] +- phy: fsl-imx8mq-usb: change ssc_range value for i.MX8MQ (Desnes Nunes) [RHEL-147798] +- phy: core: Discard pm_runtime_put() return values (Desnes Nunes) [RHEL-147798] +- usb: linux/usb.h: Correct the description of the usb_device_driver member (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: psy: Fix voltage and current max for non-Fixed PDOs (Desnes Nunes) [RHEL-147798] +- usb: typec: ucsi: psy: Fix ucsi_psy_get_current_now in non-PD cases (Desnes Nunes) [RHEL-147798] +- dt-bindings: usb: ehci/ohci: Allow "dma-coherent" (Desnes Nunes) [RHEL-147798] +- usb: typec: Export typec bus and typec altmode device type (Desnes Nunes) [RHEL-147798] +- usb: typec: Set the bus also for the port and plug altmodes (Desnes Nunes) [RHEL-147798] +- KVM: x86: Fix shadow paging use-after-free due to unexpected role (Aidan Wallace) [RHEL-192402] {CVE-2026-53359} +- KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (Aidan Wallace) [RHEL-186696] {CVE-2026-46113} +- nvme-apple: drop invalid put of admin queue reference count (Maurizio Lombardi) [RHEL-210643] +- nvme-core: warn on allocating admin tag set with existing queue (Maurizio Lombardi) [RHEL-210643] +- nvme: fix admin queue leak on controller reset (Maurizio Lombardi) [RHEL-210643] +- nvme-core: fix unsigned comparison warning in nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] +- nvmet-loop: do not alloc admin tag set during reset (Maurizio Lombardi) [RHEL-210643] +- nvme-core: align fabrics_q teardown with admin_q in nvme_free_ctrl (Maurizio Lombardi) [RHEL-210643] +- nvme: fix admin request_queue lifetime (Maurizio Lombardi) [RHEL-210643] +- nvme: add sysfs attribute to change IO timeout per controller (Maurizio Lombardi) [RHEL-210643] +- nvme: add sysfs attribute to change admin timeout per nvme controller (Maurizio Lombardi) [RHEL-210643] +- nvme: remove redundant timeout argument from nvme_wait_freeze_timeout (Maurizio Lombardi) [RHEL-210643] +- nvme: Let the blocklayer set timeouts for requests (Maurizio Lombardi) [RHEL-210643] +- Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: Fix backward compatibility with userspace (David Marlin) [RHEL-194201] +- Bluetooth: SCO: Fix data-race on sco_pi fields in sco_connect (David Marlin) [RHEL-194201] +- Bluetooth: ISO: Fix data-race on iso_pi fields in hci_get_route calls (David Marlin) [RHEL-194201] +- Bluetooth: ISO: Fix not releasing hdev reference on iso_conn_big_sync (David Marlin) [RHEL-194201] +- Bluetooth: fix memory leak in error path of hci_alloc_dev() (David Marlin) [RHEL-194201] +- Bluetooth: bnep: reject short frames before parsing (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: reject oversized Broadcast Announcement prepend (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: reject BR/EDR signaling packets over MTUsig (David Marlin) [RHEL-194201] +- Bluetooth: RFCOMM: validate skb length in MCC handlers (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: validate advertising TLV before type checks (David Marlin) [RHEL-194201] +- Bluetooth: RFCOMM: hold listener socket in rfcomm_connect_ind() (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: Reset device counters in hci_dev_close_sync() (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: Set HCI_CMD_DRAIN_WORKQUEUE during device close (David Marlin) [RHEL-194201] +- Bluetooth: ISO: serialize iso_sock_clear_timer with socket lock (David Marlin) [RHEL-194201] +- Bluetooth: ISO: fix UAF in iso_recv_frame (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: Fix possible crash on l2cap_ecred_conn_rsp (David Marlin) [RHEL-194201] +- Bluetooth: l2cap: clear chan->ident on ECRED reconfiguration success (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Use 100 ms SSR delay for rampatch and NVM loading (David Marlin) [RHEL-194201] +- Bluetooth: hci_sync: fix UAF in hci_le_create_cis_sync (David Marlin) [RHEL-194201] +- Bluetooth: 6lowpan: check skb_clone() return value in send_mcast_pkt() (David Marlin) [RHEL-194201] +- Bluetooth: btusb: Allow firmware re-download when version matches (David Marlin) [RHEL-194201] +- Bluetooth: HIDP: fix missing length checks in hidp_input_report() (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: use chan timer to close channels in cleanup_listen() (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: fix chan ref leak in l2cap_chan_timeout() on !conn (David Marlin) [RHEL-194201] +- Bluetooth: hci_conn: Fix memory leak in hci_le_big_terminate() (David Marlin) [RHEL-194201] +- Bluetooth: fix UAF in l2cap_sock_cleanup_listen() vs l2cap_conn_del() (David Marlin) [RHEL-194201] +- Bluetooth: hci_uart: fix UAFs and race conditions in close and init paths (David Marlin) [RHEL-194201] +- Bluetooth: MGMT: validate Add Extended Advertising Data length (David Marlin) [RHEL-194201] +- Bluetooth: btmtk: fix urb->setup_packet leak in error paths (David Marlin) [RHEL-194201] +- Bluetooth: ISO: drop ISO_END frames received without prior ISO_START (David Marlin) [RHEL-194201] +- Bluetooth: bnep: Fix UAF read of dev->name (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Convert timeout from jiffies to ms (David Marlin) [RHEL-194201] +- Bluetooth: L2CAP: ecred_reconfigure: send packed pdu, not stack pointer (David Marlin) [RHEL-194201] +- Bluetooth: serialize accept_q access (David Marlin) [RHEL-194201] +- Bluetooth: bnep: fix incorrect length parsing in bnep_rx_frame() extension handling (David Marlin) [RHEL-194201] +- Bluetooth: hci_qca: Migrate to serdev specific shutdown function (David Marlin) [RHEL-194201] +- Revert "Reapply "Bluetooth: revert TX timestamping" for kernel v6.18.y update" (David Marlin) [RHEL-194201] +- dpll: allow fwnode pins to attempt state change without capability bit (Michal Schmidt) [RHEL-193749] +- dpll: extend pin notifier with notification source ID (Michal Schmidt) [RHEL-193749] +- dpll: balance create/delete notifications in __dpll_pin_(un)register (Michal Schmidt) [RHEL-193749] +- dpll: guard sync-pair removal on full pin unregister (Michal Schmidt) [RHEL-193749] +- dpll: emit per-dpll delete notifications in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] +- dpll: send delete notification before unregister in on-pin rollback (Michal Schmidt) [RHEL-193749] +- dpll: fix stale iteration in dpll_pin_on_pin_unregister() (Michal Schmidt) [RHEL-193749] +- dpll: allow registering FW-identified pin with a different DPLL (Michal Schmidt) [RHEL-193749] +- dpll: add generic DPLL type (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: make frequency monitor a per-device attribute (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: use __dpll_device_change_ntf() and remove change_work (Michal Schmidt) [RHEL-193749] +- dpll: export __dpll_device_change_ntf() for use under dpll_lock (Michal Schmidt) [RHEL-193749] +- dpll: change dpll_netdev_pin_handle_size() to assume DPLL_A_PIN_ID will be used (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: fix memory leak on pin registration failure (Michal Schmidt) [RHEL-193749] +- dpll: zl3073x: Use named initializers for struct i2c_device_id (Michal Schmidt) [RHEL-193749] +- dpll: Prevent duplicate registrations (Michal Schmidt) [RHEL-193749] +- ice: dpll: fix memory leak in ice_dpll_init_info error paths (Michal Schmidt) [RHEL-177450] +- ice: dpll: set pointers to NULL after kfree in ice_dpll_deinit_info (Michal Schmidt) [RHEL-177450] +- ice: call netif_keep_dst() once when entering switchdev mode (Michal Schmidt) [RHEL-177450] +- ice: fix ice_init_link() error return preventing probe (Michal Schmidt) [RHEL-177450] +- ice: fix AQ error code comparison in ice_set_pauseparam() (Michal Schmidt) [RHEL-177450] +- ice: fix FDIR CTRL VSI resource leak in ice_reset_all_vfs() (Michal Schmidt) [RHEL-177450] +- ice: remove redundant checks from PTP init (Michal Schmidt) [RHEL-177450] +- ice: fix missing priority callbacks for U.FL DPLL pins (Michal Schmidt) [RHEL-177450] +- ice: restore PTP Rx timestamp config after ethtool set-channels (Michal Schmidt) [RHEL-177450] +- ice: ptp: use primary NAC semaphore on E825 (Michal Schmidt) [RHEL-177450] +- ice: ptp: serialize E825 PHY timer start with PTP lock (Michal Schmidt) [RHEL-177450] +- ice: fix setting promisc mode while adding VID filter (Michal Schmidt) [RHEL-177450] +- ice: fix VF queue configuration with low MTU values (Michal Schmidt) [RHEL-177450] +- ice: fix locking around wait_event_interruptible_locked_irq (Michal Schmidt) [RHEL-177450] +- ice: fix locking in ice_dcb_rebuild() (Michal Schmidt) [RHEL-177450] +- ice: fix setting RSS VSI hash for E830 (Michal Schmidt) [RHEL-177450] +- ice: dpll: Fix compilation warning (Michal Schmidt) [RHEL-177450] +- ice: mention fw_activate action along with devlink reload (Michal Schmidt) [RHEL-177450] +- ice: fix potential NULL pointer deref in error path of ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-53007} +- ice: fix race condition in TX timestamp ring cleanup (Michal Schmidt) [RHEL-177450] {CVE-2026-53008} +- ice: fix ICE_AQ_LINK_SPEED_M for 200G (Michal Schmidt) [RHEL-177450] +- ice: fix PHY config on media change with link-down-on-close (Michal Schmidt) [RHEL-177450] +- ice: fix double-free of tx_buf skb (Michal Schmidt) [RHEL-177450] {CVE-2026-53009} +- ice: fix double free in ice_sf_eth_activate() error path (Michal Schmidt) [RHEL-177450] {CVE-2026-46162} +- ice: update PCS latency settings for E825 10G/25Gb modes (Michal Schmidt) [RHEL-177450] +- ice: fix 'adjust' timer programming for E830 devices (Michal Schmidt) [RHEL-177450] +- ice: use bitmap_empty() in ice_vf_has_no_qs_ena (Michal Schmidt) [RHEL-177450] +- ice: ptp: don't WARN when controlling PF is unavailable (Michal Schmidt) [RHEL-177450] {CVE-2026-43346} +- drivers: net: ice: fix devlink parameters get without irdma (Michal Schmidt) [RHEL-177450] +- ice: Fix memory leak in ice_set_ringparam() (Michal Schmidt) [RHEL-177450] {CVE-2026-23389} +- ice: fix retry for AQ command 0x06EE (Michal Schmidt) [RHEL-177450] +- ice: reintroduce retry mechanism for indirect AQ (Michal Schmidt) [RHEL-177450] +- ice: fix adding AQ LLDP filter for VF (Michal Schmidt) [RHEL-177450] +- ice: Make name member of struct ice_cgu_pin_desc const (Michal Schmidt) [RHEL-177450] +- ice: recap the VSI and QoS info after rebuild (Michal Schmidt) [RHEL-177450] +- ice: stop counting UDP csum mismatch as rx_errors (Michal Schmidt) [RHEL-177450] +- ice: convert all ring stats to u64_stats_t (Michal Schmidt) [RHEL-177450] +- ice: shorten ring stat names and add accessors (Michal Schmidt) [RHEL-177450] +- ice: use u64_stats API to access pkts/bytes in dim sample (Michal Schmidt) [RHEL-177450] +- ice: remove ice_q_stats struct and use struct_group (Michal Schmidt) [RHEL-177450] +- ice: pass pointer to ice_fetch_u64_stats_per_ring (Michal Schmidt) [RHEL-177450] +- ice: unify PHY FW loading status handler for E800 devices (Michal Schmidt) [RHEL-177450] +- ice: dpll: fix misplaced header macros (Michal Schmidt) [RHEL-177450] +- ice: dpll: fix rclk pin state get for E810 (Michal Schmidt) [RHEL-177450] +- Revert "ice: dpll: fix rclk pin state get and misplaced header macros" (Michal Schmidt) [RHEL-177450] +- ksm: use range-walk function to jump over holes in scan_get_next_rmap_item (Nico Pache) [RHEL-189902] {CVE-2025-68211} +- net: tls: prevent chain-after-chain in plain text SG (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix silent data drop under pipe back-pressure (Sabrina Dubroca) [RHEL-152694] +- net: tls: fix strparser anchor skb leak on offload RX setup failure (Sabrina Dubroca) [RHEL-152694] +- net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption (Sabrina Dubroca) [RHEL-152694] +- tls: Purge async_hold in tls_decrypt_async_wait() (Sabrina Dubroca) [RHEL-152694] +- tls: Fix race condition in tls_sw_cancel_work_tx() (Sabrina Dubroca) [RHEL-154836] {CVE-2026-23240} +- tls: don't rely on tx_work during send() (Sabrina Dubroca) [RHEL-152694] +- tls: always set record_type in tls_process_cmsg (Sabrina Dubroca) [RHEL-152694] +- tls: wait for async encrypt in case of error during latter iterations of sendmsg (Sabrina Dubroca) [RHEL-152694] +- net: tls: wait for async completion on last message (Sabrina Dubroca) [RHEL-152694] +- tls: Use __sk_dst_get() and dst_dev_rcu() in get_netdev_for_sock(). (Sabrina Dubroca) [RHEL-189938] {CVE-2025-40149} +- ktls, sockmap: Fix missing uncharge operation (Sabrina Dubroca) [RHEL-152694] +- net: skbuff: fix missing zerocopy reference in pskb_carve helpers (Sabrina Dubroca) [RHEL-192925] +- net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177879] {CVE-2026-46323} +- net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} +- net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-178626] {CVE-2026-43503} +- net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176061] {CVE-2026-46300} +- i2c: tegra: Fix NOIRQ suspend/resume (Charles Mirabile) [RHEL-174251] +- i2c: tegra: Update Tegra410 I2C timing parameters (Charles Mirabile) [RHEL-174251] +- i2c: tegra: Disable fair arbitration for non-MCTP buses (Charles Mirabile) [RHEL-174251] +- i2c: tegra: use dmaengine_get_dma_device() for DMA buffer allocation (Charles Mirabile) [RHEL-174251] +- ipvs: reset full ip_vs_seq structs in ip_vs_conn_new (Florian Westphal) [RHEL-186601] +- ipvs: fix PMTU for GUE/GRE tunnel ICMP errors (Florian Westphal) [RHEL-186601] +- netfilter: ip6tables: mark malformed IPv6 extension headers for hotdrop (Florian Westphal) [RHEL-186601] +- netfilter: nf_nat_sip: reload possible stale data pointer (Florian Westphal) [RHEL-186601] +- netfilter: nft_fib: reject fib expression on the netdev egress hook (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: validate skb_dst() before accessing it (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: remove net variable shadowing (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix race between dump and ip_set_list resize (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't leak bad clone into future transaction (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: zero at allocation time (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: store master_tuple in expectation (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: expectation timeouts are passed in milliseconds (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: run expectation eviction with no helper (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: do not allow to reset helper on existing conntrack (Florian Westphal) [RHEL-186601] +- netfilter: nft_compat: ebtables emulation must reject non-bridge targets (Florian Westphal) [RHEL-186601] +- neigh: let neigh_xmit take skb ownership (Florian Westphal) [RHEL-186601] {CVE-2026-52981} +- netfilter: nft_meta_bridge: fix NFT_META_BRI_IIFPVID stack leak (Florian Westphal) [RHEL-186601] +- netfilter: nft_flow_offload: zero device address for non-ether case (Florian Westphal) [RHEL-186601] +- netfilter: nft_meta_bridge: add validate callback for get operations (Florian Westphal) [RHEL-186601] +- netfilter: ipset: make sure gc is properly stopped (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix order of kfree_rcu() and rcu_assign_pointer() (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Don't use test_bit() in lockless RCU readers in bitmap types (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Don't use test_bit() in lockless RCU readers in hash types (Florian Westphal) [RHEL-186601] +- netfilter: ipset: annotate "pos" for concurrent readers/writers (Florian Westphal) [RHEL-186601] +- netfilter: ipset: Fix data race between add and dump in all hash types (Florian Westphal) [RHEL-186601] +- netfilter: xt_cluster: reject template conntracks in hash match (Florian Westphal) [RHEL-186601] +- netfilter: nf_queue: pin bridge device while NFQUEUE holds fake dst (Florian Westphal) [RHEL-186601] +- netfilter: nf_dup_netdev: add nf_dev_xmit_recursion*() helpers and use them (Florian Westphal) [RHEL-186601] +- netfilter: conntrack: check NULL when retrieving ct extension (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: gc and rcu fixes (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: add sequence counter to detect tree modifications (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: split count_tree_node rbtree walk into helper (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: use per nf_conncount_data spinlocks (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: callers must hold rcu read lock (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: use per-rule hash initval (Florian Westphal) [RHEL-186601] +- netfilter: nf_conncount: fix wrong variable type (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables_offload: drop device refcount on error (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack: use get_unaligned_be32() in tcp_sack() (Florian Westphal) [RHEL-186601] +- netfilter: flowtable: avoid num_encaps underflow on bridge VLAN untag (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables_offload: add nft_flow_action_entry_next() and use it (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: skip expectations in other netns via proc (Florian Westphal) [RHEL-186601] {CVE-2026-31496} +- netfilter: nft_byteorder: remove multi-register support (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: fix dst corruption in same register operation (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: protect nf_ct_seqadj_init() with conntrack lock (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: fix unaligned memory access in timestamp adjustment (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: adjust duplicate timestamp options (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: drop packets if timestamp adjustment fails (Florian Westphal) [RHEL-186601] +- netfilter: nfnetlink_osf: fix mss parsing on big-endian architectures (Florian Westphal) [RHEL-186601] +- ipvs: clear the svc scheduler ptr early on edit (Florian Westphal) [RHEL-186601] {CVE-2026-53270} +- netfilter: nf_conntrack_irc: fix parse_dcc() off-by-one OOB read (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: use nf_ct_exp_net() in expectation dump (Florian Westphal) [RHEL-186601] +- netfilter: nft_fib: fix stale stack leak via the OIFNAME register (Florian Westphal) [RHEL-186601] {CVE-2026-53134} +- netfilter: nft_exthdr: fix register tracking for F_PRESENT flag (Florian Westphal) [RHEL-186601] {CVE-2026-53218} +- netfilter: nf_log: validate MAC header was set before dumping it (Florian Westphal) [RHEL-186601] {CVE-2026-52942} +- netfilter: x_tables: avoid leaking percpu counter pointers (Florian Westphal) [RHEL-186601] {CVE-2026-53219} +- netfilter: nf_conntrack: destroy stale expectfn expectations on unregister (Florian Westphal) [RHEL-186601] +- netfilter: revalidate bridge ports (Florian Westphal) [RHEL-186601] {CVE-2026-53220} +- netfilter: nft_ct: bail out on template ct in get eval (Florian Westphal) [RHEL-186601] {CVE-2026-53267} +- netfilter: nft_tunnel: fix use-after-free on object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-53212} +- netfilter: conntrack_irc: fix possible out-of-bounds read (Florian Westphal) [RHEL-186601] {CVE-2026-53268} +- netfilter: synproxy: add mutex to guard hook reference counting (Florian Westphal) [RHEL-186601] {CVE-2026-53269} +- netfilter: disable payload mangling in userns (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_gre: fix gre keymap list corruption (Florian Westphal) [RHEL-186601] +- netfilter: synproxy: refresh tcphdr after skb_ensure_writable (Florian Westphal) [RHEL-186601] +- netfilter: conntrack: tcp: do not force CLOSE on invalid-seq RST without direction check (Florian Westphal) [RHEL-186601] +- netfilter: nf_queue: hold bridge skb->dev while queued (Florian Westphal) [RHEL-186601] {CVE-2026-52912} +- netfilter: br_netfilter: Reallocate headroom if necessary in neigh_hh_bridge() (Florian Westphal) [RHEL-186601] +- netfilter: ip6t_hbh: reject oversized option lists (Florian Westphal) [RHEL-186601] {CVE-2026-52915} +- netfilter: ipset: stop hash:* range iteration at end (Florian Westphal) [RHEL-186601] +- netfilter: ipset: fix a potential dump-destroy race (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_helper: fix possible null deref during error log (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: fix missing expect put in obj eval (Florian Westphal) [RHEL-186601] {CVE-2026-52970} +- netfilter: nf_conntrack_sip: get helper before allocating expectation (Florian Westphal) [RHEL-186601] +- netfilter: ctnetlink: check tuple and mask in expectations created via nfqueue (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: restore helper propagation via expectation (Florian Westphal) [RHEL-186601] +- netfilter: xt_CT: fix usersize for v1 and v2 revision (Florian Westphal) [RHEL-186601] +- netfilter: nft_compat: run xt_check_hooks_{match,target}() from .validate (Florian Westphal) [RHEL-186601] +- netfilter: x_tables: add .check_hooks to matches and targets (Florian Westphal) [RHEL-186601] +- netfilter: nft_fwd_netdev: use recursion counter in neigh egress path (Florian Westphal) [RHEL-186601] +- netfilter: nft_fwd_netdev: add device and headroom validate with neigh forwarding (Florian Westphal) [RHEL-186601] +- netfilter: replace skb_try_make_writable() by skb_ensure_writable() (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_sip: don't use simple_strtoul (Florian Westphal) [RHEL-186601] {CVE-2026-52986} +- netfilter: xt_policy: fix strict mode inbound policy matching (Florian Westphal) [RHEL-186601] {CVE-2026-52920} +- netfilter: nf_tables: use list_del_rcu for netlink hooks (Florian Westphal) [RHEL-186601] {CVE-2026-46324} +- netfilter: nf_tables: Introduce functions freeing nft_hook objects (Florian Westphal) [RHEL-186601] +- netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check (Florian Westphal) [RHEL-186601] {CVE-2026-52998} +- netfilter: nfnetlink_osf: fix out-of-bounds read on option matching (Florian Westphal) [RHEL-186601] {CVE-2026-52999} +- netfilter: xtables: restrict several matches to inet family (Florian Westphal) [RHEL-186601] {CVE-2026-53001} +- netfilter: conntrack: remove sprintf usage (Florian Westphal) [RHEL-186601] {CVE-2026-53002} +- netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO (Florian Westphal) [RHEL-186601] {CVE-2026-45841} +- netfilter: nft_osf: restrict it to ipv4 (Florian Westphal) [RHEL-186601] +- netfilter: require Ethernet MAC header before using eth_hdr() (Florian Westphal) [RHEL-186601] {CVE-2026-53131} +- netfilter: x_physdev: reject empty or not-nul terminated device names (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: fix use-after-free in timeout object destroy (Florian Westphal) [RHEL-186601] {CVE-2026-31665} +- netfilter: xt_multiport: validate range encoding in checkentry (Florian Westphal) [RHEL-186601] {CVE-2026-31681} +- netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator (Florian Westphal) [RHEL-186601] {CVE-2026-43085} +- netfilter: nft_set_pipapo_avx2: remove redundant loop in lookup_slow (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: increment data in one step (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: reject immediate NF_QUEUE verdict (Florian Westphal) [RHEL-186601] {CVE-2026-43024} +- netfilter: x_tables: restrict xt_check_match/xt_check_target extensions for NFPROTO_ARP (Florian Westphal) [RHEL-186601] {CVE-2026-31424} +- netfilter: ipset: drop logically empty buckets in mtype_del (Florian Westphal) [RHEL-186601] {CVE-2026-31418} +- netfilter: ctnetlink: ignore explicit helper on new expectations (Florian Westphal) [RHEL-186601] {CVE-2026-43025} +- netfilter: ctnetlink: zero expect NAT fields when CTA_EXPECT_NAT absent (Florian Westphal) [RHEL-186601] {CVE-2026-43026} +- netfilter: ipset: use nla_strcmp for IPSET_ATTR_NAME attr (Florian Westphal) [RHEL-186601] +- netfilter: x_tables: ensure names are nul-terminated (Florian Westphal) [RHEL-186601] {CVE-2026-43028} +- netfilter: nfnetlink_log: account for netlink header size (Florian Westphal) [RHEL-186601] {CVE-2026-31416} +- netfilter: nf_conntrack_expect: store netns and zone in expectation (Florian Westphal) [RHEL-186601] +- netfilter: Reorder fields in 'struct nf_conntrack_expect' (Florian Westphal) [RHEL-186601] +- netfilter: nf_conntrack_expect: use expect->helper (Florian Westphal) [RHEL-186601] {CVE-2026-31414} +- netfilter: nf_conntrack_expect: honor expectation helper field (Florian Westphal) [RHEL-186601] +- netfilter: ip6t_rt: reject oversized addrnr in rt_mt6_check() (Florian Westphal) [RHEL-186601] {CVE-2026-31674} +- selftests: netfilter: nft_concat_range.sh: add check for flush+reload bug (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: always walk all pending catchall elements (Florian Westphal) [RHEL-186601] {CVE-2026-23278} +- netfilter: nft_set_pipapo: split gc into unlink and reclaim phase (Florian Westphal) [RHEL-186601] {CVE-2026-23351} +- netfilter: nf_tables: clone set on flush only (Florian Westphal) [RHEL-186601] {CVE-2026-23385} +- netfilter: nf_conntrack_h323: don't pass uninitialised l3num value (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: fix memory leak in nf_tables_newrule() (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add check for overlap detection bug (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: use C99 struct initializer for nft_set_iter (Florian Westphal) [RHEL-186601] +- netfilter: nft_ct: add seqadj extension for natted connections (Florian Westphal) [RHEL-186601] {CVE-2025-68206} +- netfilter: nft_objref: validate objref and objrefmap expressions (Florian Westphal) [RHEL-186601] {CVE-2025-40206} +- selftests: netfilter: nft_concat_range.sh: add check for double-create bug (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: fix skip of expired entries (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: use 0 genmask for packetpath lookups (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't check genbit from packetpath lookups (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: all transaction allocations can now sleep (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: allow iter callbacks to sleep (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: Store real pointer, adjust later. (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: split lookup function in two parts (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: don't return bogus extension pointer (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: send packets to empty set (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: adjust lockdep assertions handling (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add datapath check for map fill bug (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: prefer per element counters for testing (Florian Westphal) [RHEL-186601] +- netfilter: nft_tunnel: fix geneve_opt dump (Florian Westphal) [RHEL-186601] +- selftests: netfilter: nft_concat_range.sh: add coverage for 4bit group representation (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_hash: GC reaps elements with conncount for dynamic sets only (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: Flowtable hook's pf value never varies (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: remove the genmask parameter (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: do not defer rule destruction via call_rcu (Florian Westphal) [RHEL-186601] {CVE-2024-56655} +- netfilter: nf_tables: wait for rcu grace period on net_device removal (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: fix null deref for empty set (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prefer kvmalloc for scratch maps (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: merge pipapo_get/lookup (Florian Westphal) [RHEL-186601] +- netfilter: nft_set: remove one argument from lookup and update functions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: remove unused arguments (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: clamp maximum map bucket size to INT_MAX (Florian Westphal) [RHEL-186601] {CVE-2025-38201} +- netfilter: nft_set_pipapo: prevent overflow in lookup table allocation (Florian Westphal) [RHEL-186601] {CVE-2025-38162} +- netfilter: nf_tables: missing objects with no memcg accounting (Florian Westphal) [RHEL-186601] +- netfilter: nf_tables: allow clone callbacks to sleep (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: remove dirty flag (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: move cloning of match info to insert/removal path (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare pipapo_get helper for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: merge deactivate helper into caller (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare walk function for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: prepare destroy function for on-demand clone (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: make pipapo_clone helper return NULL (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: move prove_locking helper around (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: use GFP_KERNEL for insertions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: speed up bulk element insertions (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo: shrink data structures (Florian Westphal) [RHEL-186601] +- netfilter: nft_set_pipapo_avx2: remove redundant pointer lt (Florian Westphal) [RHEL-186601] +- net: wwan: t7xx: Add delay between MD and SAP suspend (CKI Backport Bot) [RHEL-184267] +- octeon_ep_vf: add NULL check for napi_build_skb() (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: introduce octep_vf_oq_next_idx() helper (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: avoid compiler and IQ/OQ reordering (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: Relocate counter updates before NAPI (CKI Backport Bot) [RHEL-182043] +- octeon_ep_vf: ensure dbell BADDR updation (CKI Backport Bot) [RHEL-182043] +- net: octeon_ep_vf: fix free_irq dev_id mismatch in IRQ rollback (CKI Backport Bot) [RHEL-182043] +- KVM: s390: selftests: Add IRQ routing address offset tests (Christoph Schlameuss) [RHEL-183881] +- KVM: s390: Limit adapter indicator access to mapped page (Christoph Schlameuss) [RHEL-183881] +- net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} +- net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180269] {CVE-2026-43276} +- RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180161] {CVE-2026-46117} +- RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180088] {CVE-2026-46145} +- mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171507] {CVE-2026-31669} +- tipc: fix double-free in tipc_buf_append() (Xin Long) [RHEL-152706] +- tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG (Xin Long) [RHEL-152706] +- tipc: fix divide-by-zero in tipc_sk_filter_connect() (Xin Long) [RHEL-152706] +- tipc: fix duplicate publication key in tipc_service_insert_publ() (Xin Long) [RHEL-152706] +- tipc: fix RCU dereference race in tipc_aead_users_dec() (Xin Long) [RHEL-152706] +- tipc: use kfree_sensitive() for session key material (Xin Long) [RHEL-152706] +- tipc: Fix use-after-free in tipc_mon_reinit_self(). (Xin Long) [RHEL-152706] +- sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks (Xin Long) [RHEL-152695] +- sctp: disable BH before calling udp_tunnel_xmit_skb() (Xin Long) [RHEL-152695] +- sctp: fix missing encap_port propagation for GSO fragments (Xin Long) [RHEL-152695] +- sctp: move SCTP_CMD_ASSOC_SHKEY right after SCTP_CMD_PEER_INIT (Xin Long) [RHEL-152695] +- sctp: prevent possible shift-out-of-bounds in sctp_transport_update_rto (Xin Long) [RHEL-152695] +- sctp: Hold sock lock while iterating over address list (Xin Long) [RHEL-152695] +- sctp: Prevent TOCTOU out-of-bounds write (Xin Long) [RHEL-152695] +- sctp: Hold RCU read lock while iterating over address list (Xin Long) [RHEL-152695] +- net: sctp: fix KMSAN uninit-value in sctp_inq_pop (Xin Long) [RHEL-152695] +- sctp: Defer SCTP_DBG_OBJCNT_DEC() to sctp_destroy_sock(). (Xin Long) [RHEL-152695] +- net/sctp: fix a null dereference in sctp_disposition sctp_sf_do_5_1D_ce() (Xin Long) [RHEL-152695] +- scsi: mpt3sas: Limit NVMe request size to 2 MiB (Chandrakanth Patil) [RHEL-141217] {CVE-2026-46105} +- scsi: mpt3sas: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Add configurable command retry limit for slow-to-respond devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Add firmware event requeue support for busy devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Improve device discovery and readiness handling for slow devices (Chandrakanth Patil) [RHEL-141217] +- scsi: mpt3sas: Added no_turs flag to device unblock logic (Chandrakanth Patil) [RHEL-141217] +- scsi: mpi3mr: Fix potential deadlock in mpi3mr_fault_uevent_emit (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Use proper format specifier in mpi3mr_sas_port_add() (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Drop unnecessary volatile from __iomem pointers (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix typo and grammar (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix kernel-doc issues in mpi3mr_app.c (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fix typo (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add retry mechanism for IOC shutdown with timeout reset (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add queue-full tracking for operational request queues (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Reset controller on invalid I/O completion (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Clear reset history on ready and recheck state after timeout (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add NULL checks when resetting request and reply queues (Chandrakanth Patil) [RHEL-141218] {CVE-2026-43473} +- scsi: mpi3mr: Make driver probing asynchronous (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Driver version update to 8.17.0.3.50 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Fixed the W=1 compilation warning (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Record and report controller firmware faults (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Update MPI Headers to revision 39 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Use negotiated link rate from DevicePage0 (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Avoid redundant diag-fault resets (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Rename log data save helper to reflect threaded/BH context (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Add module parameter to control threaded IRQ polling (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Simplify the workqueue allocation code (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Read missing IOCFacts flag for reply queue full overflow (Chandrakanth Patil) [RHEL-141218] +- scsi: mpi3mr: Prevent duplicate SAS/SATA device entries in channel 1 (Chandrakanth Patil) [RHEL-141218] + * Wed Jul 29 2026 CKI KWF Bot [5.14.0-731.el9] - crypto: rng - Enable pre-emption ASAP (Herbert Xu) [RHEL-92680] - net/sched: cls_api: Handle TC_ACT_CONSUMED in tcf_qevent_handle (CKI Backport Bot) [RHEL-213301] {CVE-2026-64530} diff --git a/kmap.py b/kmap.py new file mode 100755 index 000000000..70af504d1 --- /dev/null +++ b/kmap.py @@ -0,0 +1,874 @@ +#!/usr/bin/env python3 + +""" +kmap.py - Kernel Source-to-Binary Mapping Tool + +DESCRIPTION + This tool parses Linux kernel build artifacts (.cmd files, archives) to + create a JSON mapping of which source files contribute to which kernel + binaries (modules and vmlinux). It supports merging data from multiple + kernel build variants (e.g., stock, debug, rt) into a single output + file using variant indices to track per-variant mappings. + + Supported RHEL versions: 7, 8, 9, upstream + +FEATURES + - Parses .cmd files generated by kbuild to extract compilation commands + - Supports C (gcc/clang) and Rust (rustc) source files + - Handles built-in objects via built-in.o.cmd (RHEL 7), built-in.a + (RHEL 8/9), or vmlinux.a (upstream) + - Merges multiple kernel variants into single output with variant indices + - Maps modules to their containing RPM packages + +OUTPUT FORMAT + The output is a JSON file with the following structure: + + { + "variants": ["stock", "rt", ...], + "source-map": { + "obj-src": {: {: []}}, + "src-obj": {: {: []}} + }, + "module-map": { + "module-rpm": {: {: []}}, + "rpm-modules": {: {: []}} + } + } + +PARSING THE OUTPUT + import json + + with open('kernel-map.json') as f: + data = json.load(f) + + variants = data['variants'] + obj_src = data['source-map']['obj-src'] + src_obj = data['source-map']['src-obj'] + module_rpm = data['module-map']['module-rpm'] + rpm_modules = data['module-map']['rpm-modules'] + + # Get sources for vmlinux in variant "stock" (index 0) + vmlinux_sources = [src for src, indices in obj_src['vmlinux'].items() + if 0 in indices] + + # Find which object a source contributes to + fork_objects = [obj for obj, indices in src_obj['kernel/fork.c'].items() + if 0 in indices] + + # Get RPM for a module + def get_rpm(module, variant_idx): + for rpm, indices in module_rpm.get(module, {}).items(): + if variant_idx in indices: + return rpm + return None + +USAGE + # Single variant + ./kmap.py -d /build/stock -r upstream -v stock -o /output + + # Merge multiple variants + ./kmap.py -d /build/stock -r upstream -v stock -o /output + ./kmap.py -d /build/debug -r upstream -v debug -o /output -i kernel-map.json + ./kmap.py -d /build/rt -r upstream -v rt -o /output -i kernel-map.json + + # With module-to-RPM mapping + ./kmap.py -d /build -r upstream -v stock -o /output \\ + --vmlinux-rpm kernel-core-5.14.0.rpm \\ + --module-list kernel-modules-5.14.0.rpm:modules.list + +CREDITS + Inspired by gen_compile_commands.py and Joe Lawrence. + Time measurement option added for Jan Stancek. +""" + +import re +import os +import pathlib +import json +import argparse +import subprocess +import time + + +# ============================================================================= +# Constants +# ============================================================================= + +VMLINUX = 'vmlinux' +KERNEL_PREFIX = 'kernel/' + +# Supported compilers and linkers +COMPILERS = ('gcc', 'clang') +LINKER = 'ld' +RUST_COMPILER = 'rustc' + + +# ============================================================================= +# Regex Patterns +# +# These patterns parse the kernel build .cmd files to extract: +# - What compiler/linker was used +# - What source files were compiled +# - What object files were linked +# ============================================================================= + +# Pattern for .ko.cmd files (module linking) +# Matches: cmd_path/to/module.ko := ld -o +# Note: upstream kernels use 'savedcmd_' prefix instead of 'cmd_' +_KO_CMD_PATTERN = ( + r'^(saved)?cmd_[^ ]*\.ko\s*:=\s*ld\s+' + r'(?P.*) -o (?P\S+) (?P[^;]+?)\s*(?:;|$)' +) + +# Pattern for .o.cmd files (object compilation) +# Matches multiple formats: +# - C/asm: cmd_*.o := gcc/clang -o +# - Rust: cmd_*.o := rustc --emit=obj= +# - Rust source mapping: source_*.o := +_O_CMD_PATTERN = ( + r'^(saved)?(?:cmd_|source_)[^ ]*\.o\s+:=\s+' + r'(?:' + r'(?P(?:\S+=\S+\s+)*)?' + r'(?Pgcc|clang|ld|rustc)\s+' + r'(?P.*?)' + r'(?:' + r'\s+-o\s+(?P\S+)\s+(?P[^;]+?)' + r'|' + r'\s+--emit=obj=(?P\S+).*?\s+(?P\S+\.rs)' + r')' + r'|' + r'(?P\S+\.rs)' + r')\s*(?:;|$)' +) + +ko_matcher = re.compile(_KO_CMD_PATTERN) +o_matcher = re.compile(_O_CMD_PATTERN) + + +# ============================================================================= +# Utility Functions +# ============================================================================= + +def parse_args(): + """ + Parse command line arguments + """ + parser = argparse.ArgumentParser( + prog='Kernel Build Mapper', + description='Scrape Linux Kernel .cmd files to map contribution ' + 'of individual source files to kernel binaries.', + ) + + parser.add_argument('-d', '--directory', + help='Directory with kernel build artifacts.', + default='', + type=str) + + parser.add_argument('-o', '--outputdir', + help='Directory where to put generated files.', + default='', + type=str) + + parser.add_argument('-p', '--prefix', + help='Name prefix to the generated files.', + default='', + type=str) + + parser.add_argument('-r', '--rhel', + help='Specify to what version of RHEL artifacts belong (upstream for RHEL 10+/kernel-ark)', + choices=['7', '8', '9', 'upstream'], + required=True) + + parser.add_argument('-m', '--no-modules', + help='*SKIP* collecting information about modules', + action='store_true') + + parser.add_argument('-b', '--no-builtin', + help='*SKIP* collecting information about built-in', + action='store_true') + + parser.add_argument('-t', '--time', + help='Print elapsed time at the end', + action='store_true') + + parser.add_argument('-v', '--variant', + help='Name of this kernel variant (e.g., stock, debug, rt)', + required=True, + type=str) + + parser.add_argument('-i', '--input', + help='Existing JSON file to merge with (from previous variant runs)', + default='', + type=str) + + parser.add_argument('--module-list', + help='Module list in format : (can be specified multiple times)', + action='append', + default=[], + metavar='RPM:PATH') + + parser.add_argument('--vmlinux-rpm', + help='RPM package name for vmlinux (e.g., "kernel-5.14.0.rpm")', + default='', + type=str) + + return parser.parse_args() + + +def load_file(filename, build_dir=''): + """ + Load a text file and return non-empty lines as a list + """ + full_path = os.path.join(build_dir, filename) + + try: + with open(full_path, 'rt', encoding='utf-8') as file: + return [line.rstrip() for line in file if line.rstrip()] + except FileNotFoundError: + print(f'File "{full_path}" not found.') + return [] + + +def name_to_cmd(filename, suffix): + """ + Convert object filename to corresponding .cmd script filename + + Example: kernel/fork.o -> kernel/.fork.o.cmd + """ + path, _ = os.path.splitext(filename) + dirname = os.path.dirname(path) + basename = os.path.basename(path) + + return os.path.join(dirname, '.' + basename + suffix) + + +def strip_path_prefixes(path, build_dir): + """ + Normalize path by removing build directory prefix and other artifacts + """ + path = pathlib.Path(path) + + if build_dir: + try: + return str(path.resolve().relative_to(pathlib.Path(build_dir).resolve())) + except ValueError: + pass + + if path.is_absolute(): + path = pathlib.Path(*path.parts[1:]) + + while path.parts and path.parts[0] == 'repos': + path = pathlib.Path(*path.parts[1:]) + + return str(path) + + +def is_external_source(path): + """ + Check if path should be excluded from source mapping + + Filters out: + - Rust toolchain sources (not part of kernel source) + - Generated assembly files (e.g., initramfs_data.S) + """ + if 'rustlib' in path: + return True + if path.endswith('_data.S'): + return True + return False + + +def is_mod_file_reference(ld_input): + """ + Check if linker input is a .mod file reference (RHEL 9+ module linking) + + In RHEL 9+, module linking uses @path/to/module.mod files that contain + the list of object files to link. + """ + files = ld_input.split() + return len(files) == 1 and files[0].startswith('@') and files[0].endswith('.mod') + + +# ============================================================================= +# SourceMap Class +# ============================================================================= + +class SourceMap: + """ + Collects and manages kernel source-to-binary mappings. + + This class parses kernel build artifacts (.cmd files, archives) to determine + which source files contribute to which kernel binaries (modules and vmlinux). + + Data structures: + obj_to_src: {object_name: {source_file: [variant_indices]}} + src_to_obj: {source_file: {object_name: [variant_indices]}} + module_rpm: {module_name: {rpm_name: [variant_indices]}} + rpm_to_modules: {rpm_name: {module_name: [variant_indices]}} + + Variant indices correspond to positions in the 'variants' list. + """ + + # Dispatch table for RHEL-specific builtin collection methods + BUILTIN_COLLECTORS = { + '7': '_collect_builtin_rhel7', + '8': '_collect_builtin_archive', + '9': '_collect_builtin_archive', + 'upstream': '_collect_builtin_vmlinux_archive', + } + + def __init__(self, build_dir='', output_dir='', outprefix='', rhel='7', variant=''): + # Source mappings + self.obj_to_src = {} + self.src_to_obj = {} + # Module-to-RPM mappings + self.module_rpm = {} + self.rpm_to_modules = {} + + # Configuration + self.build_dir = build_dir + self.output_dir = output_dir + self.outprefix = outprefix + self.rhel = rhel + + # Module list + self.modlist = set() + + # Variant tracking for multi-variant merging + self.variants = [] + self.variant = variant + self.variant_idx = 0 + + # ------------------------------------------------------------------------- + # Variant Management + # ------------------------------------------------------------------------- + + def load_existing(self, filename): + """ + Load existing merged data from previous variant runs + """ + if not filename: + return + + full_path = os.path.join(self.output_dir, filename) if self.output_dir else filename + + if not os.path.exists(full_path): + return + + with open(full_path, 'rt', encoding='utf-8') as f: + data = json.load(f) + + self.variants = data.get('variants', []) + + module_map = data.get('module-map', {}) + self.module_rpm = module_map.get('module-rpm', {}) + self.rpm_to_modules = module_map.get('rpm-modules', {}) + + source_map = data.get('source-map', {}) + self.obj_to_src = source_map.get('obj-src', {}) + self.src_to_obj = source_map.get('src-obj', {}) + + def add_variant(self): + """ + Register current variant and store its index + """ + if self.variant in self.variants: + self.variant_idx = self.variants.index(self.variant) + else: + self.variant_idx = len(self.variants) + self.variants.append(self.variant) + + # ------------------------------------------------------------------------- + # Source Merging Helpers + # ------------------------------------------------------------------------- + + def _merge_sources(self, target, source): + """ + Merge source dict into target dict by combining variant index lists + """ + for src, indices in source.items(): + if src not in target: + target[src] = [] + for idx in indices: + if idx not in target[src]: + target[src].append(idx) + + def _add_source(self, sources, source_path): + """ + Add a source file to the sources dict with current variant index + + Returns True if source was added, False if filtered out + """ + source_path = os.path.normpath(source_path) + source_path = strip_path_prefixes(source_path, self.build_dir) + + if is_external_source(source_path): + return False + + sources[source_path] = [self.variant_idx] + return True + + # ------------------------------------------------------------------------- + # .cmd File Parsing + # ------------------------------------------------------------------------- + + def _parse_ko_cmd(self, ko_name): + """ + Parse .ko.cmd file to find the primary object file linked into the module + """ + ko_script = name_to_cmd(ko_name, '.ko.cmd') + lines = load_file(ko_script, build_dir=self.build_dir) + + for line in lines: + result = ko_matcher.match(line) + if result: + input_files = result.group('input_files').split() + return input_files[0] + + return None + + def _parse_o_cmd(self, o_name, translate=True): + """ + Parse .o.cmd file to extract source files that contribute to the object + + Handles: + - C/assembly compilation (gcc, clang) + - Linking (ld) - recursively parses linked objects + - Rust compilation (rustc) + - Rust source file mappings + + Args: + o_name: Object file name or .cmd file path + translate: If True, convert object name to .cmd path (e.g., kernel/fork.o + becomes kernel/.fork.o.cmd). If False, use o_name as-is. + This parameter exists to handle different kbuild behaviors + across RHEL versions - some code paths may already have .cmd + paths while others have object names that need translation. + """ + sources = {} + + o_script = name_to_cmd(o_name, '.o.cmd') if translate else o_name + lines = load_file(o_script, build_dir=self.build_dir) + + for line in lines: + result = o_matcher.match(line) + if not result: + continue + + command = result.group('command') + + if command in COMPILERS: + self._handle_compiler(result, sources) + break + + elif command == LINKER: + self._handle_linker(result, sources) + break + + elif command == RUST_COMPILER: + self._handle_rustc(result, sources) + break + + else: + self._handle_rust_source_mapping(result, sources) + break + + return sources + + def _handle_compiler(self, match_result, sources): + """ + Handle gcc/clang compilation - extract the input source file + """ + obj_input = match_result.group('input_files') + if obj_input: + self._add_source(sources, obj_input) + + def _handle_linker(self, match_result, sources): + """ + Handle ld linking - recursively parse linked objects + """ + obj_input = match_result.group('input_files') + if not obj_input: + return + + if is_mod_file_reference(obj_input): + self._merge_sources(sources, self._parse_mod_cmd(obj_input)) + else: + for obj_file in obj_input.split(): + self._merge_sources(sources, self._parse_o_cmd(obj_file)) + + def _handle_rustc(self, match_result, sources): + """ + Handle rustc compilation - extract the Rust source file + """ + rust_input = match_result.group('rust_input_file') + if rust_input: + self._add_source(sources, rust_input) + + def _handle_rust_source_mapping(self, match_result, sources): + """ + Handle Rust source file mapping (source_*.o := *.rs) + """ + source_file = match_result.group('source_file') + if source_file and source_file.endswith('.rs'): + self._add_source(sources, source_file) + + def _parse_mod_cmd(self, mod_name): + """ + Parse .mod file used by RHEL 9+ for linking modules + + These files contain a list of object files to link into the module. + """ + sources = {} + mod_name = mod_name.strip('@') + lines = load_file(mod_name, build_dir=self.build_dir) + + for line in lines: + self._merge_sources(sources, self._parse_o_cmd(line)) + + return sources + + def _parse_a_cmd(self, a_name): + """ + Parse archive .cmd file (RHEL 7 built-in.o.cmd files) + """ + sources = {} + lines = load_file(a_name, build_dir=self.build_dir) + + for line in lines: + result = o_matcher.match(line) + if not result: + continue + + ar_input = result.group('input_files') + for filename in ar_input.rsplit(): + if filename.endswith('.o'): + self._merge_sources(sources, self._parse_o_cmd(filename)) + elif filename.endswith('.a'): + self._merge_sources(sources, self._parse_a_cmd(filename)) + + return sources + + # ------------------------------------------------------------------------- + # Module Collection + # ------------------------------------------------------------------------- + + def _load_module_list(self, modorder='modules.order'): + """ + Load modules.order file and normalize paths + + RHEL 7, 8: modules.order has 'kernel/' prefix that needs to be stripped + RHEL 9, upstream: modules.order paths are used as-is + """ + lines = load_file(modorder, build_dir=self.build_dir) + + if not lines: + print(f'Warning: modules.order is empty or not found') + self.modlist = set() + return + + if self.rhel in ['9', 'upstream']: + self.modlist = set(lines) + else: + # RHEL 7, 8: strip fake 'kernel/' prefix added by kbuild + self.modlist = { + path[len(KERNEL_PREFIX):] if path.startswith(KERNEL_PREFIX) else path + for path in lines + } + + def _parse_module_objects(self): + """ + Parse all module .cmd files and extract source mappings. + + Note on RHEL version differences: + - RHEL 7/8/9: modules.order contains .ko paths (e.g., fs/exfat/exfat.ko) + - upstream: modules.order contains .o paths (e.g., fs/exfat/exfat.o) + + The normalization below ensures consistent .ko keys in output regardless + of the modules.order format. + """ + for kobj in self.modlist: + # Normalize to .ko - upstream has .o paths in modules.order + if self.rhel == 'upstream' and kobj.endswith('.o'): + module_name = kobj[:-2] + '.ko' + else: + module_name = kobj + + obj_name = self._parse_ko_cmd(module_name) + if obj_name is None: + print(f'Warning: Could not parse .ko.cmd for "{module_name}", skipping.') + continue + + obj_source = self._parse_o_cmd(obj_name) + if module_name not in self.obj_to_src: + self.obj_to_src[module_name] = {} + self._merge_sources(self.obj_to_src[module_name], obj_source) + + def collect_modules(self, no_modules=False, modorder='modules.order'): + """ + Collect source files for kernel modules + """ + if no_modules: + return + + self._load_module_list(modorder) + self._parse_module_objects() + + # ------------------------------------------------------------------------- + # Builtin Collection (RHEL version-specific) + # ------------------------------------------------------------------------- + + def _collect_builtin_rhel7(self): + """ + Collect built-in objects for RHEL 7 using *built-in.o.cmd files + """ + pattern = '*built-in.o.cmd' + cmd_list = { + strip_path_prefixes(path, self.build_dir) + for path in pathlib.Path(self.build_dir).rglob(pattern) + } + + for entry in cmd_list: + sources = self._parse_a_cmd(entry) + self._merge_sources(self.obj_to_src[VMLINUX], sources) + + def _collect_builtin_archive(self): + """ + Collect built-in objects for RHEL 8/9 using *built-in.a archives + """ + pattern = '*built-in.a' + archive_list = { + strip_path_prefixes(path, self.build_dir) + for path in pathlib.Path(self.build_dir).rglob(pattern) + } + + for entry in archive_list: + path = os.path.join(self.build_dir, entry) + objects = subprocess.check_output(['ar', 't', path]).decode().split() + + for obj in objects: + obj_path = strip_path_prefixes(obj, build_dir=self.build_dir) + sources = self._parse_o_cmd(obj_path) + self._merge_sources(self.obj_to_src[VMLINUX], sources) + + def _collect_builtin_vmlinux_archive(self): + """ + Collect built-in objects for upstream kernels using single vmlinux.a archive + """ + path = os.path.join(self.build_dir, 'vmlinux.a') + objects = subprocess.check_output(['ar', 't', path]).decode().split() + + for obj in objects: + obj_path = strip_path_prefixes(obj, build_dir=self.build_dir) + sources = self._parse_o_cmd(obj_path) + self._merge_sources(self.obj_to_src[VMLINUX], sources) + + def collect_builtin(self, no_builtin=False): + """ + Collect source files for vmlinux built-in objects + + Uses RHEL version-specific collection method via dispatch table. + """ + if VMLINUX not in self.obj_to_src: + self.obj_to_src[VMLINUX] = {} + + if no_builtin: + return + + collector_name = self.BUILTIN_COLLECTORS.get(self.rhel, '_collect_builtin_archive') + collector = getattr(self, collector_name) + collector() + + # ------------------------------------------------------------------------- + # Module-to-RPM Mapping + # ------------------------------------------------------------------------- + + def _parse_module_list_file(self, filename, rpm_name): + """ + Parse a module list file and add entries to module_rpm mapping + + Handles various formats: + - Absolute paths: /lib/modules/5.14.0/kernel/drivers/net/e1000.ko.xz + - Relative paths: kernel/drivers/net/e1000.ko + - Skips RPM spec directives (%dir, %defattr, etc.) + + Args: + filename: Path to the module list file + rpm_name: Literal RPM package name (e.g., "kernel-modules-5.14.0.rpm") + """ + if not filename or not os.path.exists(filename): + return + + with open(filename, 'rt', encoding='utf-8') as f: + for line in f: + line = line.strip() + + # Skip empty lines, comments, and RPM spec directives + if not line or line.startswith('#') or line.startswith('%'): + continue + + # Skip non-module files + if '.ko' not in line: + continue + + # Extract module name from path + module = os.path.basename(line) + # Remove .ko and any compression suffix + module = re.sub(r'\.ko(\.[^.]+)?$', '', module) + + if not module: + continue + + if module not in self.module_rpm: + self.module_rpm[module] = {} + + if rpm_name not in self.module_rpm[module]: + self.module_rpm[module][rpm_name] = [] + if self.variant_idx not in self.module_rpm[module][rpm_name]: + self.module_rpm[module][rpm_name].append(self.variant_idx) + + def collect_module_rpm(self, module_lists, vmlinux_rpm=''): + """ + Collect module-to-RPM name mappings from module list files + + Args: + module_lists: List of "rpm_name:path" strings + vmlinux_rpm: RPM package name for vmlinux + """ + if not module_lists and not vmlinux_rpm: + return + + # Add vmlinux to specified RPM + if vmlinux_rpm: + if VMLINUX not in self.module_rpm: + self.module_rpm[VMLINUX] = {} + if vmlinux_rpm not in self.module_rpm[VMLINUX]: + self.module_rpm[VMLINUX][vmlinux_rpm] = [] + if self.variant_idx not in self.module_rpm[VMLINUX][vmlinux_rpm]: + self.module_rpm[VMLINUX][vmlinux_rpm].append(self.variant_idx) + + # Process module list files + for entry in module_lists: + if ':' not in entry: + print(f'Warning: Invalid --module-list format "{entry}", expected RPM:PATH') + continue + + rpm_name, path = entry.split(':', 1) + self._parse_module_list_file(path, rpm_name) + + # ------------------------------------------------------------------------- + # Output + # ------------------------------------------------------------------------- + + def _build_reverse_map(self): + """ + Create reverse mapping (source -> {obj: [indices]}) from obj_to_src + """ + for obj, sources in self.obj_to_src.items(): + for source, indices in sources.items(): + if source not in self.src_to_obj: + self.src_to_obj[source] = {} + if obj not in self.src_to_obj[source]: + self.src_to_obj[source][obj] = [] + for idx in indices: + if idx not in self.src_to_obj[source][obj]: + self.src_to_obj[source][obj].append(idx) + + def _build_rpm_reverse_map(self): + """ + Create reverse mapping (rpm -> {module: [indices]}) from module_rpm + """ + for module, rpms in self.module_rpm.items(): + for rpm, indices in rpms.items(): + if rpm not in self.rpm_to_modules: + self.rpm_to_modules[rpm] = {} + if module not in self.rpm_to_modules[rpm]: + self.rpm_to_modules[rpm][module] = [] + for idx in indices: + if idx not in self.rpm_to_modules[rpm][module]: + self.rpm_to_modules[rpm][module].append(idx) + + def save_data(self): + """ + Save collected data to JSON file + + Output structure: + - variants: list of variant names + - source-map: source file mappings + - obj-src: object/module -> {source: [variant_indices]} + - src-obj: source -> {object/module: [variant_indices]} + - module-map: module to RPM mappings + - module-rpm: module name -> {rpm-name: [variant_indices]} + - rpm-modules: rpm-name -> {module name: [variant_indices]} + + Variant indices correspond to positions in the 'variants' list. + """ + output = { + 'variants': self.variants, + 'source-map': { + 'obj-src': self.obj_to_src, + 'src-obj': self.src_to_obj + }, + 'module-map': { + 'module-rpm': self.module_rpm, + 'rpm-modules': self.rpm_to_modules + } + } + + filename = self.outprefix + 'kernel-map.json' + with open(os.path.join(self.output_dir, filename), 'wt', encoding='utf-8') as f: + json.dump(output, f, indent=2, sort_keys=True) + + # ------------------------------------------------------------------------- + # Main Entry Point + # ------------------------------------------------------------------------- + + def collect_data(self, no_modules=False, no_builtin=False, modorder='modules.order', + input_file='', module_lists=None, vmlinux_rpm=''): + """ + Main entry point - collect all data and save to JSON + """ + self.load_existing(input_file) + self.add_variant() + self.collect_modules(no_modules, modorder) + self.collect_builtin(no_builtin) + self.collect_module_rpm(module_lists or [], vmlinux_rpm) + self._build_reverse_map() + self._build_rpm_reverse_map() + self.save_data() + + +# ============================================================================= +# Main +# ============================================================================= + +def main(): + """ + Main entry point + """ + args = parse_args() + + start = time.monotonic() + + source_map = SourceMap( + build_dir=args.directory, + output_dir=args.outputdir, + outprefix=args.prefix, + rhel=args.rhel, + variant=args.variant) + + source_map.collect_data( + no_modules=args.no_modules, + no_builtin=args.no_builtin, + input_file=args.input, + module_lists=args.module_list, + vmlinux_rpm=args.vmlinux_rpm) + + if args.time: + elapsed = time.monotonic() - start + minutes, seconds = divmod(int(elapsed), 60) + print(f'Elapsed time: {minutes:02d}:{seconds:02d}') + + +if __name__ == '__main__': + main() diff --git a/sources b/sources index 472918376..5201f84fd 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (linux-5.14.0-731.el9.tar.xz) = eb77d7c84d26cc0dfd34de1e44c960e3c08d9d7515279c6db5c6949415717734d732d2dfbccb75ccef3b75147fb83e06a018e78b243ccfbed41977d875ce1d8c -SHA512 (kernel-abi-stablelists-5.14.0-731.el9.tar.bz2) = 920bf9507f67e9523dfa2bda7de756451aabbb9e6cc8e6488bfe25576cfb09f5040e0712988539eae74c111fd6a75b98f9fc67a9122b0b6a3cb02e7036c8ab5c -SHA512 (kernel-kabi-dw-5.14.0-731.el9.tar.bz2) = cedc95c509a24a74f0237852c0749ea590d98bb4996c8e406555e001e4db7489b876bb186b5335f5b54627ddd98c0f3e3791073b848231afe3651fbcff8f3ae9 +SHA512 (linux-5.14.0-732.el9.tar.xz) = 78eaaafe61902c319003b347143670dbdb618404bed26f9961dd6909fc33688551086e33373a88be74d9cadb4f81335c5c001fb4a3d60781bbb18b3cc38c6484 +SHA512 (kernel-abi-stablelists-5.14.0-732.el9.tar.bz2) = 871e039e2bdee93fddd66bd59cb5b4c676903fd4b4c3b479dc3ed22ea12fa2cd783100189efe0e8529cd26b3a9f9d7366e751964ef9ff2af78639ed67985cc71 +SHA512 (kernel-kabi-dw-5.14.0-732.el9.tar.bz2) = 5f50a57755cc31acf98e1e47158b24458c9fb4aacf58cf8457697b0b7f0efbcb1f9c448a40e6f9ab9bd3e7d059a8d5a5403a16aad4a62536202a480db90975b1