diff --git a/1445-rtmutex-use-waiter-task-in-remove-waiter.patch b/1445-rtmutex-use-waiter-task-in-remove-waiter.patch deleted file mode 100644 index fa94e316c..000000000 --- a/1445-rtmutex-use-waiter-task-in-remove-waiter.patch +++ /dev/null @@ -1,86 +0,0 @@ -From 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 Mon Sep 17 00:00:00 2001 -From: Keenan Dong -Date: Wed, 8 Apr 2026 16:46:00 +0800 -Subject: [PATCH] rtmutex: Use waiter::task instead of current in - remove_waiter() - -remove_waiter() is used by the slowlock paths, but it is also used for -proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from -futex_requeue(). - -In the latter case waiter::task is not current, but remove_waiter() -operates on current for the dequeue operation. That results in several -problems: - - 1) the rbtree dequeue happens without waiter::task::pi_lock being held - - 2) the waiter task's pi_blocked_on state is not cleared, which leaves a - dangling pointer primed for UAF around. - - 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter - task - -Use waiter::task instead of current in all related operations in -remove_waiter() to cure those problems. - -[ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the - changelog ] - -Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock") -Reported-by: Yuan Tan -Reported-by: Yifan Wu -Reported-by: Juefei Pu -Reported-by: Xin Liu -Signed-off-by: Keenan Dong -Signed-off-by: Thomas Gleixner -Cc: stable@vger.kernel.org - -(cherry picked from commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349) -[AlmaLinux: adapted to a10 (6.12); context/line offsets only. scoped_guard(raw_spinlock, ...) is available in this tree (include/linux/cleanup.h + DEFINE_LOCK_GUARD_1 raw_spinlock in include/linux/spinlock.h), so the upstream form is used verbatim.] ---- - kernel/locking/rtmutex.c | 13 ++++++++----- - 1 file changed, 8 insertions(+), 5 deletions(-) - -diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index 4a8df18..e6f305d 100644 ---- a/kernel/locking/rtmutex.c -+++ b/kernel/locking/rtmutex.c -@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock, - * - * Must be called with lock->wait_lock held and interrupts disabled. It must - * have just failed to try_to_take_rt_mutex(). -+ * -+ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current ! - */ - static void __sched remove_waiter(struct rt_mutex_base *lock, - struct rt_mutex_waiter *waiter) - { - bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock)); - struct task_struct *owner = rt_mutex_owner(lock); -+ struct task_struct *waiter_task = waiter->task; - struct rt_mutex_base *next_lock; - - lockdep_assert_held(&lock->wait_lock); - -- raw_spin_lock(¤t->pi_lock); -- rt_mutex_dequeue(lock, waiter); -- current->pi_blocked_on = NULL; -- raw_spin_unlock(¤t->pi_lock); -+ scoped_guard(raw_spinlock, &waiter_task->pi_lock) { -+ rt_mutex_dequeue(lock, waiter); -+ waiter_task->pi_blocked_on = NULL; -+ } - - /* - * Only update priority if the waiter was the highest priority -@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, - raw_spin_unlock_irq(&lock->wait_lock); - - rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock, -- next_lock, NULL, current); -+ next_lock, NULL, waiter_task); - - raw_spin_lock_irq(&lock->wait_lock); - } --- -2.50.1 diff --git a/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch b/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch new file mode 100644 index 000000000..61ed42bdf --- /dev/null +++ b/1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch @@ -0,0 +1,59 @@ +From 622d621bf4f92efbab9f783c7b3068020a577061 Mon Sep 17 00:00:00 2001 +From: Nigel Croxon +Date: Thu, 7 May 2026 06:08:27 -0400 +Subject: [PATCH] md/bitmap: fix GPF in write_page caused by resize race + +JIRA: https://issues.redhat.com/browse/RHEL-129337 + +CVE: CVE-2026-43163 + +commit 46ef85f854dfa9d5226b3c1c46493d79556c9589 +Author: Jack Wang +Date: Tue Jan 20 11:24:56 2026 +0100 + +md/bitmap: fix GPF in write_page caused by resize race + +A General Protection Fault occurs in write_page() during array resize: +RIP: 0010:write_page+0x22b/0x3c0 [md_mod] + +This is a use-after-free race between bitmap_daemon_work() and +__bitmap_resize(). The daemon iterates over `bitmap->storage.filemap` +without locking, while the resize path frees that storage via +md_bitmap_file_unmap(). `quiesce()` does not stop the md thread, +allowing concurrent access to freed pages. + +Fix by holding `mddev->bitmap_info.mutex` during the bitmap update. + +Link: https://lore.kernel.org/linux-raid/20260120102456.25169-1-jinpu.wang@ionos.com +Closes: https://lore.kernel.org/linux-raid/CAMGffE=Mbfp=7xD_hYxXk1PAaCZNSEAVeQGKGy7YF9f2S4=NEA@mail.gmail.com/T/#u +Cc: stable@vger.kernel.org +Fixes: d60b479d177a ("md/bitmap: add bitmap_resize function to allow bitmap resizing.") +Signed-off-by: Jack Wang +Signed-off-by: Yu Kuai +(cherry picked from commit 46ef85f854dfa9d5226b3c1c46493d79556c9589) +Signed-off-by: Nigel Croxon + +diff --git a/drivers/md/md-bitmap.c b/drivers/md/md-bitmap.c +index 84b7e2af6dba..7bb56d0491a2 100644 +--- a/drivers/md/md-bitmap.c ++++ b/drivers/md/md-bitmap.c +@@ -2453,6 +2453,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, + memcpy(page_address(store.sb_page), + page_address(bitmap->storage.sb_page), + sizeof(bitmap_super_t)); ++ mutex_lock(&bitmap->mddev->bitmap_info.mutex); + spin_lock_irq(&bitmap->counts.lock); + md_bitmap_file_unmap(&bitmap->storage); + bitmap->storage = store; +@@ -2560,7 +2561,7 @@ static int __bitmap_resize(struct bitmap *bitmap, sector_t blocks, + set_page_attr(bitmap, i, BITMAP_PAGE_DIRTY); + } + spin_unlock_irq(&bitmap->counts.lock); +- ++ mutex_unlock(&bitmap->mddev->bitmap_info.mutex); + if (!init) { + __bitmap_unplug(bitmap); + bitmap->mddev->pers->quiesce(bitmap->mddev, 0); +-- +2.50.1 (Apple Git-155) + diff --git a/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch b/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch new file mode 100644 index 000000000..389d75644 --- /dev/null +++ b/1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch @@ -0,0 +1,91 @@ +From 7bba8926cefe321fdcbe281278ddaeb0a8f8cc2b Mon Sep 17 00:00:00 2001 +From: Waiman Long +Date: Tue, 28 Apr 2026 15:46:48 -0400 +Subject: [PATCH] rtmutex: Use waiter::task instead of current in + remove_waiter() + +JIRA: https://redhat.atlassian.net/browse/RHEL-171746 + +commit 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 +Author: Keenan Dong +Date: Wed, 8 Apr 2026 16:46:00 +0800 + + rtmutex: Use waiter::task instead of current in remove_waiter() + + remove_waiter() is used by the slowlock paths, but it is also used for + proxy-lock rollback in rt_mutex_start_proxy_lock() when invoked from + futex_requeue(). + + In the latter case waiter::task is not current, but remove_waiter() + operates on current for the dequeue operation. That results in several + problems: + + 1) the rbtree dequeue happens without waiter::task::pi_lock being held + + 2) the waiter task's pi_blocked_on state is not cleared, which leaves a + dangling pointer primed for UAF around. + + 3) rt_mutex_adjust_prio_chain() operates on the wrong top priority waiter + task + + Use waiter::task instead of current in all related operations in + remove_waiter() to cure those problems. + + [ tglx: Fixup rt_mutex_adjust_prio_chain(), add a comment and amend the + changelog ] + + Fixes: 8161239a8bcc ("rtmutex: Simplify PI algorithm and make highest prio task get lock") + Reported-by: Yuan Tan + Reported-by: Yifan Wu + Reported-by: Juefei Pu + Reported-by: Xin Liu + Signed-off-by: Keenan Dong + Signed-off-by: Thomas Gleixner + Cc: stable@vger.kernel.org + +Signed-off-by: Waiman Long + +diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c +index 4a8df1800cbb..e6f305dea2a6 100644 +--- a/kernel/locking/rtmutex.c ++++ b/kernel/locking/rtmutex.c +@@ -1534,20 +1534,23 @@ static bool rtmutex_spin_on_owner(struct rt_mutex_base *lock, + * + * Must be called with lock->wait_lock held and interrupts disabled. It must + * have just failed to try_to_take_rt_mutex(). ++ * ++ * When invoked from rt_mutex_start_proxy_lock() waiter::task != current ! + */ + static void __sched remove_waiter(struct rt_mutex_base *lock, + struct rt_mutex_waiter *waiter) + { + bool is_top_waiter = (waiter == rt_mutex_top_waiter(lock)); + struct task_struct *owner = rt_mutex_owner(lock); ++ struct task_struct *waiter_task = waiter->task; + struct rt_mutex_base *next_lock; + + lockdep_assert_held(&lock->wait_lock); + +- raw_spin_lock(¤t->pi_lock); +- rt_mutex_dequeue(lock, waiter); +- current->pi_blocked_on = NULL; +- raw_spin_unlock(¤t->pi_lock); ++ scoped_guard(raw_spinlock, &waiter_task->pi_lock) { ++ rt_mutex_dequeue(lock, waiter); ++ waiter_task->pi_blocked_on = NULL; ++ } + + /* + * Only update priority if the waiter was the highest priority +@@ -1583,7 +1586,7 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, + raw_spin_unlock_irq(&lock->wait_lock); + + rt_mutex_adjust_prio_chain(owner, RT_MUTEX_MIN_CHAINWALK, lock, +- next_lock, NULL, current); ++ next_lock, NULL, waiter_task); + + raw_spin_lock_irq(&lock->wait_lock); + } +-- +2.50.1 (Apple Git-155) + diff --git a/1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch b/1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch similarity index 73% rename from 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch rename to 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch index b692b6c4b..d077011a0 100644 --- a/1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch +++ b/1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch @@ -1,9 +1,11 @@ -From 40a25d59e85b3c8709ac2424d44f65610467871e Mon Sep 17 00:00:00 2001 +From 5799f9bd7fee40370b93ab1ddf001cdc7017c14d Mon Sep 17 00:00:00 2001 From: Davidlohr Bueso -Date: Thu, 7 May 2026 04:29:13 -0700 +Date: Tue, 16 Jun 2026 15:06:01 -0400 Subject: [PATCH] locking/rtmutex: Skip remove_waiter() when waiter is not enqueued +[ Upstream commit 40a25d59e85b3c8709ac2424d44f65610467871e ] + syzbot triggered the following splat in remove_waiter() via FUTEX_CMP_REQUEUE_PI: @@ -31,19 +33,14 @@ Signed-off-by: Thomas Gleixner Cc: stable@vger.kernel.org Closes: https://lore.kernel.org/all/69f114ac.050a0220.ac8b.0003.GAE@google.com/ Link: https://patch.msgid.link/20260507112913.1019537-1-dave@stgolabs.net - -(cherry picked from commit 40a25d59e85b3c8709ac2424d44f65610467871e) -[AlmaLinux: adapted to a10 (6.12); context/line offsets only. Both hunks apply: remove_waiter() in kernel/locking/rtmutex.c (depends on waiter_task local from 3bfdc63936dd) and rt_mutex_start_proxy_lock() in kernel/locking/rtmutex_api.c. In this tree __rt_mutex_start_proxy_lock() returns 1 on try_to_take_rt_mutex() success, so the ret<0 tightening is required to avoid calling remove_waiter() on lock acquisition.] ---- - kernel/locking/rtmutex.c | 3 +++ - kernel/locking/rtmutex_api.c | 2 +- - 2 files changed, 4 insertions(+), 1 deletion(-) +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman diff --git a/kernel/locking/rtmutex.c b/kernel/locking/rtmutex.c -index e6f305d..15111dc 100644 +index 8fdbd2931801..7110ee98391e 100644 --- a/kernel/locking/rtmutex.c +++ b/kernel/locking/rtmutex.c -@@ -1547,6 +1547,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, +@@ -1550,6 +1550,9 @@ static void __sched remove_waiter(struct rt_mutex_base *lock, lockdep_assert_held(&lock->wait_lock); @@ -54,7 +51,7 @@ index e6f305d..15111dc 100644 rt_mutex_dequeue(lock, waiter); waiter_task->pi_blocked_on = NULL; diff --git a/kernel/locking/rtmutex_api.c b/kernel/locking/rtmutex_api.c -index 6614ccd..341a540 100644 +index 2bc14c049a64..091b109acdc5 100644 --- a/kernel/locking/rtmutex_api.c +++ b/kernel/locking/rtmutex_api.c @@ -347,7 +347,7 @@ int __sched rt_mutex_start_proxy_lock(struct rt_mutex_base *lock, @@ -67,4 +64,5 @@ index 6614ccd..341a540 100644 preempt_disable(); raw_spin_unlock_irq(&lock->wait_lock); -- -2.50.1 +2.50.1 (Apple Git-155) + diff --git a/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch b/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch new file mode 100644 index 000000000..c8d3af944 --- /dev/null +++ b/1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch @@ -0,0 +1,42 @@ +From 74e144274af39935b0f410c0ee4d2b91c3730414 Mon Sep 17 00:00:00 2001 +From: Ji'an Zhou +Date: Tue, 2 Jun 2026 09:12:04 +0000 +Subject: [PATCH] futex/requeue: Prevent NULL pointer dereference in + remove_waiter() on self-deadlock + +When FUTEX_CMP_REQUEUE_PI requeues a non-top waiter that already owns the +target PI futex, task_blocks_on_rt_mutex() returns -EDEADLK before setting +waiter->task. + +The subsequent remove_waiter() in rt_mutex_start_proxy_lock() dereferences +the NULL waiter->task, causing a kernel crash. + +Add a self-deadlock check for non-top waiters before calling +rt_mutex_start_proxy_lock(), analogous to the top-waiter check in +futex_lock_pi_atomic(). + +Fixes: 3bfdc63936dd4773109b7b8c280c0f3b5ae7d349 ("rtmutex: Use waiter::task instead of current in remove_waiter()") +Signed-off-by: Ji'an Zhou +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org + +diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c +index b597cb3d17fc..1d99a84dc9ad 100644 +--- a/kernel/futex/requeue.c ++++ b/kernel/futex/requeue.c +@@ -643,6 +643,12 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, + continue; + } + ++ /* Self-deadlock: non-top waiter already owns the PI futex. */ ++ if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { ++ ret = -EDEADLK; ++ break; ++ } ++ + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, + this->rt_waiter, + this->task); +-- +2.50.1 (Apple Git-155) + diff --git a/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch b/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch new file mode 100644 index 000000000..1aeddd19c --- /dev/null +++ b/1455-futex-requeue-revert-prevent-null-pointer-dereference.patch @@ -0,0 +1,48 @@ +From 39def6d250d370298f86c116f4ac60093cefadaa Mon Sep 17 00:00:00 2001 +From: Sebastian Andrzej Siewior +Date: Wed, 1 Jul 2026 15:11:50 +0200 +Subject: [PATCH] futex/requeue: Revert "Prevent NULL pointer dereference in + remove_waiter() on self-deadlock"" + +The commit cited below should not have been merged. It attemted to fix an +existing problem ansd thereby introduced new problems by keeping the +pi_state in state Q_REQUEUE_PI_IN_PROGRESS and leaking it. + +Based on the commit description the intention was to handle the case +when task_blocks_on_rt_mutex() returns -EDEADLK and the following +remove_waiter() dereferences the NULL pointer in waiter->task. + +That is already handled by Davidlohr in commit 40a25d59e85b3 +("locking/rtmutex: Skip remove_waiter() when waiter is not enqueued") and +requires no further acting. + +Revert the commit breaking the "waiter == owner" case again. + +Fixes: 74e144274af39 ("futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock") +Reported-by: Michael Bommarito +Signed-off-by: Sebastian Andrzej Siewior +Signed-off-by: Thomas Gleixner +Cc: stable@vger.kernel.org +Link: https://patch.msgid.link/20260701131150.0Ijhq4Dw@linutronix.de +Closes: https://lore.kernel.org/all/20260629020049.2082397-1-michael.bommarito@gmail.com + +diff --git a/kernel/futex/requeue.c b/kernel/futex/requeue.c +index 7384672916fb..79823ad13683 100644 +--- a/kernel/futex/requeue.c ++++ b/kernel/futex/requeue.c +@@ -645,12 +645,6 @@ int futex_requeue(u32 __user *uaddr1, unsigned int flags1, + continue; + } + +- /* Self-deadlock: non-top waiter already owns the PI futex. */ +- if (rt_mutex_owner(&pi_state->pi_mutex) == this->task) { +- ret = -EDEADLK; +- break; +- } +- + ret = rt_mutex_start_proxy_lock(&pi_state->pi_mutex, + this->rt_waiter, + this->task); +-- +2.50.1 (Apple Git-155) + diff --git a/kernel.spec b/kernel.spec index ec2204744..a4a9106d2 100644 --- a/kernel.spec +++ b/kernel.spec @@ -176,13 +176,13 @@ Summary: The Linux kernel %define specrpmversion 6.12.0 %define specversion 6.12.0 %define patchversion 6.12 -%define pkgrelease 211.32.1 +%define pkgrelease 211.33.1 %define kversion 6 %define tarfile_release 6.12.0-211.7.1.el10_2 # This is needed to do merge window version magic %define patchlevel 12 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 211.32.1%{?buildid}%{?dist} +%define specrelease 211.33.1%{?buildid}%{?dist} # This defines the kabi tarball version %define kabiversion 6.12.0-211.7.1.el10_2 @@ -1473,12 +1473,15 @@ Patch1441: 1441-eventpoll-fix-semi-unbounded-recursion.patch Patch1442: 1442-eventpoll-drop-vestigial-epi-dying-flag.patch Patch1443: 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch Patch1444: 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -Patch1445: 1445-rtmutex-use-waiter-task-in-remove-waiter.patch -Patch1446: 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch Patch1447: 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch Patch1448: 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch Patch1449: 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch Patch1450: 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch +Patch1451: 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch +Patch1452: 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch +Patch1453: 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch +Patch1454: 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch +Patch1455: 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch # END OF PATCH DEFINITIONS %description @@ -2674,12 +2677,15 @@ ApplyPatch 1441-eventpoll-fix-semi-unbounded-recursion.patch ApplyPatch 1442-eventpoll-drop-vestigial-epi-dying-flag.patch ApplyPatch 1443-eventpoll-fix-integer-overflow-in-ep-loop-check-proc.patch ApplyPatch 1444-eventpoll-refresh-epi-fget-ep-remove-file-comments.patch -ApplyPatch 1445-rtmutex-use-waiter-task-in-remove-waiter.patch -ApplyPatch 1446-rtmutex-skip-remove-waiter-when-not-enqueued.patch ApplyPatch 1447-sctp-revalidate-list-cursor-after-sctp-sendmsg-to-asoc-in-sctp-sendall.patch ApplyPatch 1448-net-sched-ets-always-remove-class-from-active-list-before-deleting.patch ApplyPatch 1449-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-gfn.patch ApplyPatch 1450-kvm-x86-fix-shadow-paging-use-after-free-due-to-unexpected-role.patch +ApplyPatch 1451-md-bitmap-fix-gpf-in-write-page-caused-by-resize-race.patch +ApplyPatch 1452-rtmutex-use-waiter-task-instead-of-current-in-remove-waiter.patch +ApplyPatch 1453-locking-rtmutex-skip-remove-waiter-when-waiter-is-not-enqueued.patch +ApplyPatch 1454-futex-requeue-prevent-null-pointer-dereference-in-remove-waiter.patch +ApplyPatch 1455-futex-requeue-revert-prevent-null-pointer-dereference.patch # END OF PATCH APPLICATIONS # Any further pre-build tree manipulations happen here. @@ -5184,6 +5190,19 @@ fi\ # # %changelog +* Mon Jul 13 2026 Andrew Lukoshko - 6.12.0-211.33.1 +- Recreate RHEL 6.12.0-211.33.1 from CentOS Stream 10 and upstream stable backports (1451-1455) +- The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499 + (1445, 1446) are superseded by RHEL's copies and dropped +- RHEL changelog for 211.33.1 follows: + +* Thu Jul 09 2026 CKI KWF Bot [6.12.0-211.33.1.el10_2] +- futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (CKI Backport Bot) [RHEL-193250] {CVE-2026-53166} +- futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (CKI Backport Bot) [RHEL-193250] {CVE-2026-43499} +- locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} +- rtmutex: Use waiter::task instead of current in remove_waiter() (CKI Backport Bot) [RHEL-193153] {CVE-2026-43499} +- md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174092] {CVE-2026-43163} + * Thu Jul 09 2026 Andrew Lukoshko - 6.12.0-211.32.1 - Recreate RHEL 6.12.0-211.32.1 from upstream stable backports (1447-1450) - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1415, 1416) are