From 264edaecf7650c28ca1a4be7f262bc4b7715f365 Mon Sep 17 00:00:00 2001 From: CKI KWF Bot Date: Tue, 18 Aug 2026 22:16:06 +0000 Subject: [PATCH] kernel-5.14.0-739.el9 * Tue Aug 18 2026 CKI KWF Bot [5.14.0-739.el9] - mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668] - posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560} - posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370} - posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838] - posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838] - posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838] - posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838] - posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838] - posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838] - posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838] - Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} - Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} - cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556] - sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556] - sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991} - i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191} - net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048} - iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324} - iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325} - iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932] - iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329} - iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220} - iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253} - iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932] - iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932] - iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932] - iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932] - iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932] - iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932] - iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932] - iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289} - iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164} - iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] - iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290} - iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] - iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932] - iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932] - iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932] - iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932] - iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932] - iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591} - dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932] - dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932] - iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932] - iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291} - iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932] - drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] - gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] - iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932] - iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932] - iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932] - iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283} - iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932] - iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293} - iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932] - iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053} - iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372} - iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932] - dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932] - iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932] - iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932] - iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932] - dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932] - iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932] - iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932] - iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932] - iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122} - iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932] - dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921] - dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921] - dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921] - dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921] - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501} Resolves: RHEL-153668, RHEL-178418, RHEL-213921, RHEL-213932, RHEL-227838, RHEL-230091, RHEL-231355, RHEL-232106, RHEL-232556 Signed-off-by: CKI KWF Bot --- Makefile.rhelver | 2 +- kernel.changelog | 82 ++++++++++++++++++++++++++++++++++++++++++++ kernel.spec | 89 +++++++++++++++++++++++++++++++++++++++++++++--- sources | 6 ++-- 4 files changed, 171 insertions(+), 8 deletions(-) diff --git a/Makefile.rhelver b/Makefile.rhelver index 4d69aa9bf..3abf71ffa 100644 --- a/Makefile.rhelver +++ b/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 9 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 738 +RHEL_RELEASE = 739 # # ZSTREAM diff --git a/kernel.changelog b/kernel.changelog index 30f733e05..8e93a92a2 100644 --- a/kernel.changelog +++ b/kernel.changelog @@ -1,3 +1,85 @@ +* Tue Aug 18 2026 CKI KWF Bot [5.14.0-739.el9] +- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668] +- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560} +- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370} +- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838] +- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838] +- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556] +- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556] +- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991} +- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191} +- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048} +- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324} +- iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325} +- iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932] +- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329} +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220} +- iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253} +- iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932] +- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932] +- iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932] +- iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932] +- iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932] +- iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289} +- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164} +- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290} +- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932] +- iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591} +- dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932] +- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932] +- iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932] +- iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291} +- iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932] +- drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932] +- iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283} +- iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932] +- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293} +- iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053} +- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372} +- iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932] +- dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932] +- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932] +- iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122} +- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932] +- dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921] +- dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921] +- dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921] +- dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501} +Resolves: RHEL-153668, RHEL-178418, RHEL-213921, RHEL-213932, RHEL-227838, RHEL-230091, RHEL-231355, RHEL-232106, RHEL-232556 + * Mon Aug 17 2026 CKI KWF Bot [5.14.0-738.el9] - scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339] - scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339] diff --git a/kernel.spec b/kernel.spec index 80dfbea73..30e4814c9 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,15 +176,15 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 738 +%define pkgrelease 739 %define kversion 5 -%define tarfile_release 5.14.0-738.el9 +%define tarfile_release 5.14.0-739.el9 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 738%{?buildid}%{?dist} +%define specrelease 739%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-738.el9 +%define kabiversion 5.14.0-739.el9 # # End of genspec.sh variables @@ -3881,6 +3881,87 @@ fi # # %changelog +* Tue Aug 18 2026 CKI KWF Bot [5.14.0-739.el9] +- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668] +- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560} +- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370} +- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838] +- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838] +- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556] +- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556] +- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991} +- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191} +- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048} +- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324} +- iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325} +- iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932] +- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329} +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220} +- iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253} +- iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932] +- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932] +- iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932] +- iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932] +- iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932] +- iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289} +- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164} +- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290} +- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932] +- iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591} +- dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932] +- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932] +- iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932] +- iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291} +- iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932] +- drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932] +- iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283} +- iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932] +- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293} +- iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053} +- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372} +- iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932] +- dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932] +- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932] +- iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122} +- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932] +- dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921] +- dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921] +- dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921] +- dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501} + * Mon Aug 17 2026 CKI KWF Bot [5.14.0-738.el9] - scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339] - scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339] diff --git a/sources b/sources index ba07b0bc2..b50adc3b8 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (linux-5.14.0-738.el9.tar.xz) = 953c78914af5ebd06205fa70ddef9efaa8dc16b9cae686b2ee759827734d7eb4509df95651443c5e8d7fdc414bd3b8bc2e92278a17d0aef1f9a905f000c4e107 -SHA512 (kernel-abi-stablelists-5.14.0-738.el9.tar.bz2) = 6de983b72caa87b2ff19d029859304f990b34924cf10ebc72d5ac92c77098aa2618d532969220e60ba7cdea8efa58ee03cdddc0cacd8c2e6377c4b56bb9da3fb -SHA512 (kernel-kabi-dw-5.14.0-738.el9.tar.bz2) = a6b8aa58146d43d43b062e734f2fa0f08a093b7e7e36076f45c4c280b71c20628cb910fea5a960b75a72fa7fb2bc72172f2eac6cc3bfd21329c34f0593783dc2 +SHA512 (linux-5.14.0-739.el9.tar.xz) = 9a18f455f4173b6d9dc9e38b1a359276a7ee9a66d4a4a230d92af9599357864f2b3774535cb48889bbaf1fd3e592dd97d8f09e589b0a6d3a6ec52972ba15a657 +SHA512 (kernel-abi-stablelists-5.14.0-739.el9.tar.bz2) = f131d02a9a189b1a9e7798cc7d953d86fd698926745aecdf1a02b58cf65f1c563006d7e3bbeb3f5692787f39ea9d38a1525de5c13180537ee23bf8d7d66283b6 +SHA512 (kernel-kabi-dw-5.14.0-739.el9.tar.bz2) = 948c3d6e2bbc667ecb68e1e51374476c3014c52e33cda3347bbfdfffd88286932a7f495dfe4d6f0ae8e3ffd94277266d5375a19ed373ea5775fc7135d81a0e47