From 46acf40c59957d042b1043da9e70d8374b6bf647 Mon Sep 17 00:00:00 2001 From: CKI KWF Bot Date: Thu, 23 Jul 2026 09:47:54 +0000 Subject: [PATCH] kernel-4.18.0-553.147.1.el8_10 * Thu Jul 23 2026 CKI KWF Bot [4.18.0-553.147.1.el8_10] - KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} - KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] - KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] - KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] - KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} - KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] - KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] - KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] - KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] - serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] - tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] - dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} - xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] - selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] - selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] - x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] - mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] - mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] - mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] Resolves: RHEL-127174, RHEL-152655, RHEL-166738, RHEL-178324, RHEL-188543, RHEL-190191, RHEL-192178, RHEL-211228, RHEL-213341 Signed-off-by: CKI KWF Bot --- kernel.spec | 28 ++++++++++++++++++++++++++-- sources | 6 +++--- 2 files changed, 29 insertions(+), 5 deletions(-) diff --git a/kernel.spec b/kernel.spec index 9a25240b2..cac18b2a0 100644 --- a/kernel.spec +++ b/kernel.spec @@ -49,10 +49,10 @@ # define buildid .local %define specversion 4.18.0 -%define pkgrelease 553.146.1.el8_10 +%define pkgrelease 553.147.1.el8_10 # allow pkg_release to have configurable %%{?dist} tag -%define specrelease 553.146.1%{?dist} +%define specrelease 553.147.1%{?dist} %define pkg_release %{specrelease}%{?buildid} @@ -2723,6 +2723,30 @@ fi # # %changelog +* Thu Jul 23 2026 CKI KWF Bot [4.18.0-553.147.1.el8_10] +- KVM: x86/mmu: Ensure hugepage is in by slot before checking max mapping level (Aidan Wallace) [RHEL-213341] {CVE-2026-63807} +- KVM: nVMX: Hide shadow VMCS right after VMCLEAR (Aidan Wallace) [RHEL-213341] +- KVM: x86: Check for invalid/obsolete root *after* making MMU pages available (Aidan Wallace) [RHEL-213341] +- KVM: nVMX: Put vmcs12 pages if nested VM-Enter fails due to invalid guest state (Aidan Wallace) [RHEL-213341] +- KVM: nVMX: Add helper to put (unmap) vmcs12 pages (Aidan Wallace) [RHEL-213341] +- KVM: nVMX: Use kvm_vcpu_map() to get/pin vmcs12's APIC-access page (Aidan Wallace) [RHEL-213341] +- KVM: x86: Don't (re)check L1 intercepts when completing userspace I/O (Aidan Wallace) [RHEL-211228] {CVE-2025-40026} +- KVM: x86: wean in-kernel PIO from vcpu->arch.pio* (Aidan Wallace) [RHEL-211228] +- KVM: x86: move all vcpu->arch.pio* setup in emulator_pio_in_out() (Aidan Wallace) [RHEL-211228] +- KVM: x86: drop PIO from unregistered devices (Aidan Wallace) [RHEL-211228] +- KVM: x86: inline kernel_pio into its sole caller (Aidan Wallace) [RHEL-211228] +- serial: 8250_mid: Disable DMA for selected platforms (Mark Salter) [RHEL-190191] +- tipc: fix double-free in tipc_buf_append() (CKI Backport Bot) [RHEL-192178] {CVE-2026-52993} +- xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178324] +- dm log: fix out-of-bounds write due to region_count overflow (CKI Backport Bot) [RHEL-188543] {CVE-2026-53059} +- xfs: Use xarray to track SB UUIDs instead of plain array. (Lukas Herbolt) [RHEL-127174] +- selftests: kvm: try getting XFD and XSAVE state out of sync (Paolo Bonzini) [RHEL-166738] +- selftests: kvm: replace numbering of sync points with actions (Paolo Bonzini) [RHEL-166738] +- x86/fpu: Clear XSTATE_BV[i] in guest XSAVE state whenever XFD[i]=1 (Paolo Bonzini) [RHEL-166738] +- mount: Retest MNT_LOCKED in do_umount (Ian Kent) [RHEL-152655] +- mount: Don't allow copying MNT_UNBINDABLE|MNT_LOCKED mounts (Ian Kent) [RHEL-152655] +- mount: Prevent MNT_DETACH from disconnecting locked mounts (Ian Kent) [RHEL-152655] + * Mon Jul 20 2026 CKI KWF Bot [4.18.0-553.146.1.el8_10] - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (Gaurav Goklani) [RHEL-180153] {CVE-2026-46117} - PCI: vmd: Make vmd_dev::cfg_lock a raw_spinlock_t type (Herton R. Krzesinski) [RHEL-174916] diff --git a/sources b/sources index e361fa87f..1c22b168b 100644 --- a/sources +++ b/sources @@ -1,3 +1,3 @@ -SHA512 (linux-4.18.0-553.146.1.el8_10.tar.xz) = f1515d6232d583de4cdb8a53adc3410870866ff1caaaf3caa94cd3e480bb510dedc394d9f9fc06ed8e2349104164ccfe2aa7cc2eb055dcf02ec52a64ee3d58ae -SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 9725fbb4bb5e1ed0e2852a1779210df5653036c8f3c281973ba20dbf223341eb78805bc3af946c812b1f3950ddd53ef02c173398a36591de121f129304cc9d3d -SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = d249a80d09ab31c8e207e5ee6c1957c7941095fad540108fabf84ed0939b18c4f640386243e0291250f5f89f8d5ddda300f5dd084c46d3c13ed6b350a36788fd +SHA512 (linux-4.18.0-553.147.1.el8_10.tar.xz) = 18e4e5fbe1989b561dd6c4cbd1f787c8a4a041955ce92a4e90f282f5d477614b0ed747d55fd8eaf05beecebb55aa68bb4148e4b308b0a35a5fb75f47a4a74231 +SHA512 (kernel-abi-stablelists-4.18.0-553.tar.bz2) = 82dbafa3b79e4d8717a08d2bbe1c9a0ea4ee846e79df20fb6ad9f2f3623b1df881235eb9151bedc163ce457440320764099b8172458868bfc20a5de4397e0c37 +SHA512 (kernel-kabi-dw-4.18.0-553.tar.bz2) = d44110cef5336d6aa0f33dddf739ee7fd5b295b3bf2913ea2a21737fb45716eea505de453b287cebcf0154804af0b5fb6403ded5285be0e0eef78eaa1f08a057