diff --git a/.gitignore b/.gitignore index 50a253322..b9791ad1a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,6 +1,6 @@ -SOURCES/kernel-abi-stablelists-5.14.0-736.el9.tar.bz2 -SOURCES/kernel-kabi-dw-5.14.0-736.el9.tar.bz2 -SOURCES/linux-5.14.0-736.el9.tar.xz +SOURCES/kernel-abi-stablelists-5.14.0-741.el9.tar.bz2 +SOURCES/kernel-kabi-dw-5.14.0-741.el9.tar.bz2 +SOURCES/linux-5.14.0-741.el9.tar.xz SOURCES/nvidiabfdpu.x509 SOURCES/nvidiagpuoot001.x509 SOURCES/nvidiajetsonsoc.x509 diff --git a/.kernel.metadata b/.kernel.metadata index 711ba59a3..3d8e988f0 100644 --- a/.kernel.metadata +++ b/.kernel.metadata @@ -1,6 +1,6 @@ -a2d64b91f360698e465556e3a75a9c58772d63fa SOURCES/kernel-abi-stablelists-5.14.0-736.el9.tar.bz2 -cad17230cfd7ac5ef225af2b922bc936e540c115 SOURCES/kernel-kabi-dw-5.14.0-736.el9.tar.bz2 -fd5a061ba87695ce3d78cb7086862c99557bb077 SOURCES/linux-5.14.0-736.el9.tar.xz +78eb1eaf7ea5c7afb454ec6552d1d2044547a192 SOURCES/kernel-abi-stablelists-5.14.0-741.el9.tar.bz2 +5b1d84b058f21701fb5bb8d5abd8ac83ab50e4bb SOURCES/kernel-kabi-dw-5.14.0-741.el9.tar.bz2 +499875ab7518c7873311a853ee325c58bd89d48b SOURCES/linux-5.14.0-741.el9.tar.xz 3dc4997e0273ca116d52a52238a57403aba5dafb SOURCES/nvidiabfdpu.x509 4fff8080e88afffc06d8ef5004db8d53bb21237f SOURCES/nvidiagpuoot001.x509 18378ab150ef13ef65609224e10a2e8501d82915 SOURCES/nvidiajetsonsoc.x509 diff --git a/SOURCES/Makefile.rhelver b/SOURCES/Makefile.rhelver index 359c0a6f6..ae8a181bc 100644 --- a/SOURCES/Makefile.rhelver +++ b/SOURCES/Makefile.rhelver @@ -12,7 +12,7 @@ RHEL_MINOR = 9 # # Use this spot to avoid future merge conflicts. # Do not trim this comment. -RHEL_RELEASE = 736 +RHEL_RELEASE = 741 # # ZSTREAM diff --git a/SOURCES/kernel-aarch64-64k-debug-rhel.config b/SOURCES/kernel-aarch64-64k-debug-rhel.config index 5e321cfa5..c447c9744 100644 --- a/SOURCES/kernel-aarch64-64k-debug-rhel.config +++ b/SOURCES/kernel-aarch64-64k-debug-rhel.config @@ -6536,6 +6536,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-64k-rhel.config b/SOURCES/kernel-aarch64-64k-rhel.config index 981e5db01..8f0bee964 100644 --- a/SOURCES/kernel-aarch64-64k-rhel.config +++ b/SOURCES/kernel-aarch64-64k-rhel.config @@ -6511,6 +6511,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-debug-rhel.config b/SOURCES/kernel-aarch64-debug-rhel.config index 518c1a3fb..3c950fcb2 100644 --- a/SOURCES/kernel-aarch64-debug-rhel.config +++ b/SOURCES/kernel-aarch64-debug-rhel.config @@ -6534,6 +6534,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-rhel.config b/SOURCES/kernel-aarch64-rhel.config index 88348c8c7..52e7fa552 100644 --- a/SOURCES/kernel-aarch64-rhel.config +++ b/SOURCES/kernel-aarch64-rhel.config @@ -6509,6 +6509,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-rt-64k-debug-rhel.config b/SOURCES/kernel-aarch64-rt-64k-debug-rhel.config index 959734526..cc50e710c 100644 --- a/SOURCES/kernel-aarch64-rt-64k-debug-rhel.config +++ b/SOURCES/kernel-aarch64-rt-64k-debug-rhel.config @@ -6639,6 +6639,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-rt-64k-rhel.config b/SOURCES/kernel-aarch64-rt-64k-rhel.config index d17742c3e..069ac585a 100644 --- a/SOURCES/kernel-aarch64-rt-64k-rhel.config +++ b/SOURCES/kernel-aarch64-rt-64k-rhel.config @@ -6614,6 +6614,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-rt-debug-rhel.config b/SOURCES/kernel-aarch64-rt-debug-rhel.config index ebfc98079..f6db99089 100644 --- a/SOURCES/kernel-aarch64-rt-debug-rhel.config +++ b/SOURCES/kernel-aarch64-rt-debug-rhel.config @@ -6637,6 +6637,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-aarch64-rt-rhel.config b/SOURCES/kernel-aarch64-rt-rhel.config index 47c7bac56..5dcdbc5aa 100644 --- a/SOURCES/kernel-aarch64-rt-rhel.config +++ b/SOURCES/kernel-aarch64-rt-rhel.config @@ -6612,6 +6612,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-ppc64le-debug-rhel.config b/SOURCES/kernel-ppc64le-debug-rhel.config index 1af7784b3..7fcde99e1 100644 --- a/SOURCES/kernel-ppc64le-debug-rhel.config +++ b/SOURCES/kernel-ppc64le-debug-rhel.config @@ -5977,6 +5977,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-ppc64le-rhel.config b/SOURCES/kernel-ppc64le-rhel.config index ce23ddb96..57bc6349e 100644 --- a/SOURCES/kernel-ppc64le-rhel.config +++ b/SOURCES/kernel-ppc64le-rhel.config @@ -5954,6 +5954,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-s390x-debug-rhel.config b/SOURCES/kernel-s390x-debug-rhel.config index c3a804e20..647e59016 100644 --- a/SOURCES/kernel-s390x-debug-rhel.config +++ b/SOURCES/kernel-s390x-debug-rhel.config @@ -5966,6 +5966,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-s390x-rhel.config b/SOURCES/kernel-s390x-rhel.config index 3eb3a8157..8384e32b6 100644 --- a/SOURCES/kernel-s390x-rhel.config +++ b/SOURCES/kernel-s390x-rhel.config @@ -5943,6 +5943,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-s390x-zfcpdump-rhel.config b/SOURCES/kernel-s390x-zfcpdump-rhel.config index 61e36b330..3c2fe07b4 100644 --- a/SOURCES/kernel-s390x-zfcpdump-rhel.config +++ b/SOURCES/kernel-s390x-zfcpdump-rhel.config @@ -5967,6 +5967,7 @@ CONFIG_TCM_IBLOCK=y CONFIG_TCM_PSCSI=y # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-x86_64-debug-rhel.config b/SOURCES/kernel-x86_64-debug-rhel.config index dd5b59b83..b7f83aac3 100644 --- a/SOURCES/kernel-x86_64-debug-rhel.config +++ b/SOURCES/kernel-x86_64-debug-rhel.config @@ -6303,6 +6303,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-x86_64-rhel.config b/SOURCES/kernel-x86_64-rhel.config index d0d76ae19..b24c28451 100644 --- a/SOURCES/kernel-x86_64-rhel.config +++ b/SOURCES/kernel-x86_64-rhel.config @@ -6279,6 +6279,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-x86_64-rt-debug-rhel.config b/SOURCES/kernel-x86_64-rt-debug-rhel.config index bc9107837..75868eeec 100644 --- a/SOURCES/kernel-x86_64-rt-debug-rhel.config +++ b/SOURCES/kernel-x86_64-rt-debug-rhel.config @@ -6404,6 +6404,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel-x86_64-rt-rhel.config b/SOURCES/kernel-x86_64-rt-rhel.config index ac4da972b..7b4cafcd1 100644 --- a/SOURCES/kernel-x86_64-rt-rhel.config +++ b/SOURCES/kernel-x86_64-rt-rhel.config @@ -6380,6 +6380,7 @@ CONFIG_TCM_IBLOCK=m CONFIG_TCM_PSCSI=m # CONFIG_TCM_QLA2XXX is not set CONFIG_TCM_USER2=m +CONFIG_TCP_AO=y CONFIG_TCP_CONG_ADVANCED=y CONFIG_TCP_CONG_BBR=m CONFIG_TCP_CONG_BIC=m diff --git a/SOURCES/kernel.changelog b/SOURCES/kernel.changelog index 81790a5db..18591ad03 100644 --- a/SOURCES/kernel.changelog +++ b/SOURCES/kernel.changelog @@ -1,3 +1,403 @@ +* Fri Aug 21 2026 CKI KWF Bot [5.14.0-741.el9] +- dm cache policy smq: check allocation under invalidate lock (Benjamin Marzinski) [RHEL-231826] {CVE-2026-53062} +- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190190] +- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190190] {CVE-2026-53246} +- sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234286] {CVE-2026-64564} +- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231453] {CVE-2026-64277} +- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230265] {CVE-2026-64276} +- sctp: prevent peer transport count overflow (CKI Backport Bot) [RHEL-214461] +- sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212388] +- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188202] {CVE-2026-52924} +- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182345] {CVE-2026-53266} +- ipv6: add NULL checks for idev in SRv6 paths (CKI Backport Bot) [RHEL-152701] +Resolves: RHEL-152701, RHEL-182345, RHEL-188202, RHEL-190190, RHEL-212388, RHEL-214461, RHEL-230265, RHEL-231453, RHEL-231826, RHEL-234286 + +* Thu Aug 20 2026 CKI KWF Bot [5.14.0-740.el9] +- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226701] {CVE-2026-43493} +- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228526] {CVE-2026-63952} +- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228526] +- perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Implement global init callback for GNR uncore (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Move die_to_cpu() to uncore.c (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Guard against invalid box control address (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems (Michael Petlan) [RHEL-115125] +- perf/x86/intel: Fix OMR snoop information parsing issues (Michael Petlan) [RHEL-115121] +- perf/x86/intel/uncore: Remove extra double quote mark (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix die ID init and look up bugs (Michael Petlan) [RHEL-115125] {CVE-2026-43344} +- perf/x86/intel/uncore: Skip discovery table for offline dies (Michael Petlan) [RHEL-115125] {CVE-2026-43079} +- perf/x86/intel/uncore: Fix iounmap() leak on global_init failure (Michael Petlan) [RHEL-115125] +- perf/x86/intel: Enable auto counter reload for DMR (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add support for rdpmc user disable feature (Michael Petlan) [RHEL-117336] +- perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Michael Petlan) [RHEL-117336] +- KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros (Michael Petlan) [RHEL-117336] +- KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) (Michael Petlan) [RHEL-117336] +- perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag (Michael Petlan) [RHEL-117336] +- perf/x86: Use macros to replace magic numbers in attr_rdpmc (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add core PMU support for Novalake (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add support for PEBS memory auxiliary info field in NVL (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add core PMU support for DMR (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR (Michael Petlan) [RHEL-115121] +- perf/uapi: Clean up a bit (Michael Petlan) [RHEL-115121] +- tools headers: Update the uapi/linux/perf_event.h copy with the kernel sources (Michael Petlan) [RHEL-115121] +- perf: Extend per event callchain limit to branch stack (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Add a check for dynamic constraints (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Disable PMI for self-reloaded ACR events (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Optimize PEBS extended config (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Always reprogram ACR events to prevent stale masks (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Improve validation and configuration of ACR masks (Anubhav Shelat) [RHEL-45125] {CVE-2026-53370} +- perf/x86: Fix potential bad container_of in intel_pmu_hw_config (Anubhav Shelat) [RHEL-45125] {CVE-2026-31782} +- perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error (Anubhav Shelat) [RHEL-45125] {CVE-2025-40122} +- perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Use early_initcall() to hook bts_init() (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Add counter group support for arch-PEBS (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Setup PEBS data configuration and enable legacy groups (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Update dyn_constraint base on PEBS event precise level (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Process arch-PEBS records or record fragments (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Factor out PEBS group processing code to functions (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Allow to update user space GPRs from PEBS records (Anubhav Shelat) [RHEL-45125] +- perf/core: Check sample_type in perf_sample_save_callchain (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Remove redundant assignments to sample.period (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Factor out PEBS record processing code to functions (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Initialize architectural PEBS (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Introduce pairs of PEBS static calls (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Parse CPUID archPerfmonExt leaves for non-hybrid CPUs (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Rename x86_pmu.pebs to x86_pmu.ds_pebs (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Decouple BTS initialization from PEBS initialization (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Correct large PEBS flag check (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Support auto counter reload (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Use better start period for frequency mode (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Add CPUID enumeration for the auto counter reload (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Track the num of events needs late setup (Anubhav Shelat) [RHEL-45125] +- perf/x86: Add dynamic constraint (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/uncore: Convert comma to semicolon (Michael Petlan) [RHEL-117338] +- perf/x86/intel/uncore: Add Nova Lake support (Michael Petlan) [RHEL-117338] +- perf/x86/intel/uncore: Add missing PMON units for Panther Lake (Michael Petlan) [RHEL-115125] +- perf pmu: Relax uncore wildcard matching to allow numeric suffix (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Update DMR uncore constraints preliminarily (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support uncore constraint ranges (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support IIO free-running counters on DMR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add freerunning event descriptor helper macro (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add domain global init callback (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Remove has_generic_discovery_table() (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support per-platform discovery base devices (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Move uncore discovery init struct to header (Michael Petlan) [RHEL-115125] +- perf/x86/intel/cstate: Add Diamond Rapids support (Michael Petlan) [RHEL-115123] +- perf/x86/intel/cstate: Add Nova Lake support (Michael Petlan) [RHEL-120358] +- perf/x86/intel/cstate: Add Wildcat Lake support (Michael Petlan) [RHEL-95669] +Resolves: RHEL-115121, RHEL-115123, RHEL-115125, RHEL-117336, RHEL-117338, RHEL-120358, RHEL-226701, RHEL-228526, RHEL-45125, RHEL-95669 + +* Tue Aug 18 2026 CKI KWF Bot [5.14.0-739.el9] +- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668] +- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560} +- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370} +- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838] +- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838] +- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556] +- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556] +- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991} +- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191} +- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048} +- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324} +- iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325} +- iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932] +- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329} +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220} +- iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253} +- iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932] +- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932] +- iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932] +- iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932] +- iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932] +- iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289} +- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164} +- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290} +- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932] +- iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591} +- dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932] +- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932] +- iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932] +- iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291} +- iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932] +- drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932] +- iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283} +- iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932] +- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293} +- iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053} +- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372} +- iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932] +- dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932] +- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932] +- iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122} +- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932] +- dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921] +- dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921] +- dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921] +- dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501} +Resolves: RHEL-153668, RHEL-178418, RHEL-213921, RHEL-213932, RHEL-227838, RHEL-230091, RHEL-231355, RHEL-232106, RHEL-232556 + +* Mon Aug 17 2026 CKI KWF Bot [5.14.0-738.el9] +- scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339] +- scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339] +- scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl (Don Brace) [RHEL-224339] +- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (Don Brace) [RHEL-224339] +- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886} +- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886} +- platform/x86/intel/tpmi/plr: Prevent fault during unbind (Dennis Chen) [RHEL-212707] +- platform/x86: intel: Add notifiers support (Dennis Chen) [RHEL-212707] +- x86/fpu: Ensure XFD state on signal delivery (Dennis Chen) [RHEL-212652] +- platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (Dennis Chen) [RHEL-212719] +- ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: ps: disable MSI on resume in ACP PCI driver (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/tas2781: Cancel async firmware request at unbind (Jaroslav Kysela) [RHEL-193254] +- firmware_loader: Add cancel helper for async requests (Jaroslav Kysela) [RHEL-193254] +- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (Jaroslav Kysela) [RHEL-193254] +- ALSA: scarlett2: Allow selecting config_set by firmware version (Jaroslav Kysela) [RHEL-193254] +- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: topology: validate vendor array size before parsing (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc4-control: Validate notification payload size (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 (Jaroslav Kysela) [RHEL-193254] +- ALSA: FCP: Fix NULL pointer dereference in interface lookup (Jaroslav Kysela) [RHEL-193254] +- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (Jaroslav Kysela) [RHEL-193254] +- ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: clear opened when stream enable fails (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: reject stream disable with no active interface (Jaroslav Kysela) [RHEL-193254] +- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Free sideband sg_table objects (Jaroslav Kysela) [RHEL-193254] +- soundwire: intel_ace2x: release bpt_stream when close it (Jaroslav Kysela) [RHEL-193254] +- soundwire: fix bug in sdw_add_element_group_count found by syzkaller (Jaroslav Kysela) [RHEL-193254] +- soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral (Jaroslav Kysela) [RHEL-193254] +- mfd: cs42l43: Sanity check firmware size (Jaroslav Kysela) [RHEL-193254] +- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: avoid stale FIFO cells during resize (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: oss: Serialize readq reset state with q->lock (Jaroslav Kysela) [RHEL-193254] +- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Guard sideband endpoint removal (Jaroslav Kysela) [RHEL-193254] +- ASoC: topology: Check PCM and DAI name strings before use (Jaroslav Kysela) [RHEL-193254] +- ASoC: tegra: tegra210_ahub: Validate written enum value (Jaroslav Kysela) [RHEL-193254] +- ASoC: fsl: fsl_audmix: Validate written enum values (Jaroslav Kysela) [RHEL-193254] +- ASoC: meson: aiu: Validate written enum values (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: hdac_hdmi: Validate written enum value (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=y (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer() (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: aw88261: fix incorrect masks for boost regs (Jaroslav Kysela) [RHEL-193254] +- ASoC: sma1307: Fix uevent string leaks in fault worker (Jaroslav Kysela) [RHEL-193254] +- ALSA: aloop: Drop superfluous break (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Clear variable event pointer on read (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Fix partial userptr event expansion (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: fix Kconfig dependency of HD Audio PCI (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Initialize offload control return value (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (Jaroslav Kysela) [RHEL-193254] +- ALSA: xen-front: Connect event channel after stream prepare (Jaroslav Kysela) [RHEL-193254] +- ALSA: xen-front: Reset event channel state on stream clear (Jaroslav Kysela) [RHEL-193254] +- ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: Fix cached processing coefficient verbs (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: conexant: Remove mic bias threshold override (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/realtek: Add quirk for TongFang X6xx45xU (Jaroslav Kysela) [RHEL-193254] +- ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Roll back quirk control caches on write errors (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: avoid kobject path lookup in DualSense match (Jaroslav Kysela) [RHEL-193254] {CVE-2026-64478} +- ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 (Jaroslav Kysela) [RHEL-193254] +- KVM: s390: Fall back to short-term pinning in MAP ioctl (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Enable adapter_indicators_set to use mapped pages (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Add map/unmap ioctl and clean mappings post-guest (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: get rid of gmap_translate() (Christoph Schlameuss) [RHEL-136457] +- selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-150728] +- kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-150728] +- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-150728] {CVE-2026-43084} +- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-150728] +- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-150728] +- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Luis Claudio R. Goncalves) [RHEL-186591] +- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188519] {CVE-2026-53000} +- kernel.spec.template: add tcp_ao kselftests (Davide Caratti) [RHEL-142637] +- Kconfig: enable CONFIG_TCP_AO (Davide Caratti) [RHEL-142637] +- tcp: Decrement tcp_md5_needed static branch (Davide Caratti) [RHEL-142637] +- net/tcp-ao: fix use-after-free of key in del_async path (Davide Caratti) [RHEL-142637] +- sockptr: fix usize check in copy_struct_from_sockptr() for user pointers (Davide Caratti) [RHEL-142637] +- tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Davide Caratti) [RHEL-142637] +- tcp: restore RCU grace period in tcp_ao_destroy_sock (Davide Caratti) [RHEL-142637] +- selftests/net: Synchronize client/server before counters checks (Davide Caratti) [RHEL-142637] +- selftests/net: Fix various spelling mistakes in TCP-AO tests (Davide Caratti) [RHEL-142637] +- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Printing fixes to confirm with format-security (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Fix fscanf() call for format-security (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Zero-init tcp_ao_info_opt (Davide Caratti) [RHEL-142637] +- selftests/net: Amend per-netns counter checks (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Make RST tests less flaky (Davide Caratti) [RHEL-142637] +- selftests/net: Repair RST passive reset selftest (Davide Caratti) [RHEL-142637] +- tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO. (Davide Caratti) [RHEL-142637] +- tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). (Davide Caratti) [RHEL-142637] +- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Davide Caratti) [RHEL-142637] {CVE-2025-39852} +- selftests/net: Rectify key counters checks (Davide Caratti) [RHEL-142637] +- selftests/net: Argument value mismatch when calling verify_counters() (Davide Caratti) [RHEL-142637] +- selftests: tcp_ao: set the timeout to 2 minutes (Davide Caratti) [RHEL-142637] +- selftests: tcp_ao: add a config file (Davide Caratti) [RHEL-142637] +- selftests/net/tcp-ao: Use LDLIBS instead of LDFLAGS (Davide Caratti) [RHEL-142637] +- net/tcp_sigpool: Use kref_get_unless_zero() (Davide Caratti) [RHEL-142637] +- selftest/tcp-ao: Rectify out-of-tree build (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO key-management test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO selfconnect/simultaneous connect test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO RST test (Davide Caratti) [RHEL-142637] +- selftests/net: Add SEQ number extension test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP_REPAIR TCP-AO tests (Davide Caratti) [RHEL-142637] +- selftests/net: Add test/benchmark for removing MKTs (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests (Davide Caratti) [RHEL-142637] +- selftests/net: Add test for TCP-AO add setsockopt() command (Davide Caratti) [RHEL-142637] +- selftests/net: Add a test for TCP-AO keys matching (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO ICMPs accept test (Davide Caratti) [RHEL-142637] +- selftests/net: Verify that TCP-AO complies with ignoring ICMPs (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO library (Davide Caratti) [RHEL-142637] +- net/tcp-ao: Fix MAC comparison to be constant-time (Davide Caratti) [RHEL-142637] {CVE-2026-43384} +- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Davide Caratti) [RHEL-142637] {CVE-2025-39950} +- tcp: Free TCP-AO/TCP-MD5 info/keys without RCU (Davide Caratti) [RHEL-142637] +- tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() (Davide Caratti) [RHEL-142637] +- net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals (Davide Caratti) [RHEL-142637] +- net/tcp: Disable TCP-AO static key after RCU grace period (Davide Caratti) [RHEL-142637] {CVE-2024-43887} +- net/tcp_ao: Don't leak ao_info on error-path (Davide Caratti) [RHEL-142637] {CVE-2024-40985} +- Documentation/tcp-ao: Add a few lines on tracepoints (Davide Caratti) [RHEL-142637] +- net/tcp: Remove tcp_hash_fail() (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp-md5 and tcp-ao tracepoints (Davide Caratti) [RHEL-142637] +- net/tcp: Move tcp_inbound_hash() from headers (Davide Caratti) [RHEL-142637] +- net/tcp: Add a helper tcp_ao_hdr_maclen() (Davide Caratti) [RHEL-142637] +- net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs (Davide Caratti) [RHEL-142637] +- net/tcp: Only produce AO/MD5 logs if there are any keys (Davide Caratti) [RHEL-142637] +- tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie(). (Davide Caratti) [RHEL-142637] +- tcp: Cache sock_net(sk) in cookie_v[46]_check(). (Davide Caratti) [RHEL-142637] +- net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED (Davide Caratti) [RHEL-142637] +- tcp: Fix Use-After-Free in tcp_ao_connect_init (Davide Caratti) [RHEL-142637] {CVE-2024-27394} +- net: tcp: remove call to obsolete crypto_ahash_alignmask() (Davide Caratti) [RHEL-142637] +- net/tcp: Don't store TCP-AO maclen on reqsk (Davide Caratti) [RHEL-142637] +- net/tcp: Don't add key with non-matching VRF on connected sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Consistently align TCP-AO option in the header (Davide Caratti) [RHEL-142637] +- tcp: Fix SYN option room calculation for TCP-AO. (Davide Caratti) [RHEL-142637] +- Documentation/tcp: Fix an obvious typo (Davide Caratti) [RHEL-142637] +- tcp: Fix -Wc23-extensions in tcp_options_write() (Davide Caratti) [RHEL-142637] +- net/tcp_sigpool: Fix some off by one bugs (Davide Caratti) [RHEL-142637] +- net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() (Davide Caratti) [RHEL-142637] +- Documentation/tcp: Add TCP-AO documentation (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP_AO_REPAIR (Davide Caratti) [RHEL-142637] +- net/tcp: Wire up l3index to TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Add static_key for TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO getsockopt()s (Davide Caratti) [RHEL-142637] +- net/tcp: Add option for TCP-AO to (not) hash header (Davide Caratti) [RHEL-142637] +- net/tcp: Ignore specific ICMPs for TCP-AO connections (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp_hash_fail() ratelimited logs (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO SNE support (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO segments counters (Davide Caratti) [RHEL-142637] +- net/tcp: Verify inbound TCP-AO signed segments (Davide Caratti) [RHEL-142637] +- net/tcp: Sign SYN-ACK segments with TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Wire TCP-AO to request sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO sign to twsk (Davide Caratti) [RHEL-142637] +- net/tcp: Add AO sign to RST packets (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp_parse_auth_options() (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO sign to outgoing packets (Davide Caratti) [RHEL-142637] +- net/tcp: Calculate TCP-AO traffic keys (Davide Caratti) [RHEL-142637] +- net/tcp: Prevent TCP-MD5 with TCP-AO being set (Davide Caratti) [RHEL-142637] +- net/tcp: Introduce TCP_AO setsockopt()s (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO config and structures (Davide Caratti) [RHEL-142637] +- net/tcp: Prepare tcp_md5sig_pool for TCP-AO (Davide Caratti) [RHEL-142637] +- tcp: Update stale comment for MD5 in tcp_parse_options(). (Davide Caratti) [RHEL-142637] +- tcp: Disable header prediction for MD5 flow. (Davide Caratti) [RHEL-142637] +- tcp: use 2-arg optimal variant of kfree_rcu() (Davide Caratti) [RHEL-142637] +- net/tcp: Separate initialization of twsk (Davide Caratti) [RHEL-142637] +- net/tcp: Do cleanup on tcp_md5_key_copy() failure (Davide Caratti) [RHEL-142637] +- net/tcp: Disable TCP-MD5 static key on tcp_md5sig_info destruction (Davide Caratti) [RHEL-142637] +- net/tcp: Separate tcp_md5sig_info allocation into tcp_md5sig_info_add() (Davide Caratti) [RHEL-142637] +- tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 (Davide Caratti) [RHEL-142637] +- tcp: annotate data-race around tcp_md5sig_pool_populated (Davide Caratti) [RHEL-142637] +- crypto: cipher - On clone do crypto_mod_get() (Davide Caratti) [RHEL-142637] +- crypto: api - Add __crypto_alloc_tfmgfp (Davide Caratti) [RHEL-142637] +- crypto: cmac - Add support for cloning (Davide Caratti) [RHEL-142637] +- crypto: cipher - Add crypto_clone_cipher (Davide Caratti) [RHEL-142637] +- crypto: cmac - Use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637] +- crypto: shash - Allow cloning on algorithms with no init_tfm (Davide Caratti) [RHEL-142637] +- crypto: cryptd - Add support for cloning hashes (Davide Caratti) [RHEL-142637] +- crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637] +- crypto: hmac - Add support for cloning (Davide Caratti) [RHEL-142637] +- crypto: hash - Add crypto_clone_ahash/shash (Davide Caratti) [RHEL-142637] +- crypto: api - Add crypto_clone_tfm (Davide Caratti) [RHEL-142637] +- crypto: api - Add crypto_tfm_get (Davide Caratti) [RHEL-142637] +- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (Petr Oros) [RHEL-155154] +Resolves: RHEL-136457, RHEL-142637, RHEL-150728, RHEL-155154, RHEL-186591, RHEL-188519, RHEL-193254, RHEL-212652, RHEL-212707, RHEL-212719, RHEL-224339, RHEL-231655 + +* Thu Aug 13 2026 CKI KWF Bot [5.14.0-737.el9] +- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-222675] +- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224537] +- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (David Arcari) [RHEL-212721] +- thermal: intel: int340x: Fix potential shift overflow in ptc_mmio_write() (David Arcari) [RHEL-212721] +- bnxt_en: Fix NULL pointer dereference (CKI Backport Bot) [RHEL-185084] +Resolves: RHEL-185084, RHEL-212721, RHEL-222675, RHEL-224537 + * Tue Aug 11 2026 CKI KWF Bot [5.14.0-736.el9] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-222801] - i2c: core: fix adapter deregistration race (David Arcari) [RHEL-222902] {CVE-2026-64279} diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec index e1c597ea5..fc10528cb 100644 --- a/SPECS/kernel.spec +++ b/SPECS/kernel.spec @@ -176,15 +176,15 @@ Summary: The Linux kernel # define buildid .local %define specversion 5.14.0 %define patchversion 5.14 -%define pkgrelease 736 +%define pkgrelease 741 %define kversion 5 -%define tarfile_release 5.14.0-736.el9 +%define tarfile_release 5.14.0-741.el9 # This is needed to do merge window version magic %define patchlevel 14 # This allows pkg_release to have configurable %%{?dist} tag -%define specrelease 736%{?buildid}%{?dist} +%define specrelease 741%{?buildid}%{?dist} # This defines the kabi tarball version -%define kabiversion 5.14.0-736.el9 +%define kabiversion 5.14.0-741.el9 # # End of genspec.sh variables @@ -2853,7 +2853,7 @@ fi pushd tools/testing/selftests # We need to install here because we need to call make with ARCH set which # doesn't seem possible to do in the install section. -%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf cgroup kmod mm livepatch net net/forwarding net/hsr net/mptcp net/netfilter tc-testing memfd drivers/net/bonding iommu cachestat drivers/net" SKIP_TARGETS="" FORCE_TARGETS=1 INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" DEFAULT_INSTALL_HDR_PATH=0 install +%{make} %{?_smp_mflags} ARCH=$Arch V=1 TARGETS="bpf cgroup kmod mm livepatch net net/forwarding net/hsr net/mptcp net/netfilter net/tcp_ao tc-testing memfd drivers/net/bonding iommu cachestat drivers/net" SKIP_TARGETS="" FORCE_TARGETS=1 INSTALL_PATH=%{buildroot}%{_libexecdir}/kselftests VMLINUX_H="${RPM_VMLINUX_H}" DEFAULT_INSTALL_HDR_PATH=0 install # 'make install' for bpf is broken and upstream refuses to fix it. # Install the needed files manually. @@ -3238,6 +3238,12 @@ find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{} find -type f -executable -exec install -D -m755 {} %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{} \; find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/kselftests/net/mptcp/{} \; popd +# install net/tcp_ao selftests +pushd tools/testing/selftests/net/tcp_ao +find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \; +find -type f -executable -exec install -D -m755 {} %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \; +find -type f ! -executable -exec install -D -m644 {} %{buildroot}%{_libexecdir}/kselftests/net/tcp_ao/{} \; +popd # install tc-testing selftests pushd tools/testing/selftests/tc-testing find -type d -exec install -d %{buildroot}%{_libexecdir}/kselftests/tc-testing/{} \; @@ -3875,6 +3881,401 @@ fi # # %changelog +* Fri Aug 21 2026 CKI KWF Bot [5.14.0-741.el9] +- dm cache policy smq: check allocation under invalidate lock (Benjamin Marzinski) [RHEL-231826] {CVE-2026-53062} +- sctp: validate embedded INIT chunk and address list lengths in cookie (Xin Long) [RHEL-190190] +- sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing (Xin Long) [RHEL-190190] {CVE-2026-53246} +- sctp: don't free the ASCONF's own transport in DEL-IP processing (CKI Backport Bot) [RHEL-234286] {CVE-2026-64564} +- Input: synaptics-rmi4 - bound the F3A keymap to the GPIO count (CKI Backport Bot) [RHEL-231453] {CVE-2026-64277} +- Input: synaptics-rmi4 - bound the F30 keymap to the GPIO/LED count (CKI Backport Bot) [RHEL-230265] {CVE-2026-64276} +- sctp: prevent peer transport count overflow (CKI Backport Bot) [RHEL-214461] +- sctp: hold socket lock when dumping endpoints in sctp_diag (Jamie Bainbridge) [RHEL-212388] +- sctp: purge outqueue on stale COOKIE-ECHO handling (CKI Backport Bot) [RHEL-188202] {CVE-2026-52924} +- netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182345] {CVE-2026-53266} +- ipv6: add NULL checks for idev in SRv6 paths (CKI Backport Bot) [RHEL-152701] + +* Thu Aug 20 2026 CKI KWF Bot [5.14.0-740.el9] +- crypto: pcrypt - Fix handling of MAY_BACKLOG requests (Ricardo Robaina) [RHEL-226701] {CVE-2026-43493} +- memfd: deny writeable mappings when implying SEAL_WRITE (Luiz Capitulino) [RHEL-228526] {CVE-2026-63952} +- mm/memfd: fix spelling in memfd_add_seals() (Luiz Capitulino) [RHEL-228526] +- perf/x86/intel/uncore: Fix uncore_die_to_cpu() for offline dies (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Implement global init callback for GNR uncore (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Move die_to_cpu() to uncore.c (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Guard against invalid box control address (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix discovery unit lookup for multi-die systems (Michael Petlan) [RHEL-115125] +- perf/x86/intel: Fix OMR snoop information parsing issues (Michael Petlan) [RHEL-115121] +- perf/x86/intel/uncore: Remove extra double quote mark (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix die ID init and look up bugs (Michael Petlan) [RHEL-115125] {CVE-2026-43344} +- perf/x86/intel/uncore: Skip discovery table for offline dies (Michael Petlan) [RHEL-115125] {CVE-2026-43079} +- perf/x86/intel/uncore: Fix iounmap() leak on global_init failure (Michael Petlan) [RHEL-115125] +- perf/x86/intel: Enable auto counter reload for DMR (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add support for rdpmc user disable feature (Michael Petlan) [RHEL-117336] +- perf/x86: Print PMU counters bitmap in x86_pmu_show_pmu_cap() (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add ICL_FIXED_0_ADAPTIVE bit into INTEL_FIXED_BITS_MASK (Michael Petlan) [RHEL-117336] +- KVM: x86/pmu: Manipulate FIXED_CTR_CTRL MSR with macros (Michael Petlan) [RHEL-117336] +- KVM: x86/pmu: Change ambiguous _mask suffix to _rsvd in kvm_pmu (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Change macro GLOBAL_CTRL_EN_PERF_METRICS to BIT_ULL(48) (Michael Petlan) [RHEL-117336] +- perf/x86: Add PERF_CAP_PEBS_TIMING_INFO flag (Michael Petlan) [RHEL-117336] +- perf/x86: Use macros to replace magic numbers in attr_rdpmc (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add core PMU support for Novalake (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add support for PEBS memory auxiliary info field in NVL (Michael Petlan) [RHEL-117336] +- perf/x86/intel: Add core PMU support for DMR (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Add support for PEBS memory auxiliary info field in DMR (Michael Petlan) [RHEL-115121] +- perf/uapi: Clean up a bit (Michael Petlan) [RHEL-115121] +- tools headers: Update the uapi/linux/perf_event.h copy with the kernel sources (Michael Petlan) [RHEL-115121] +- perf: Extend per event callchain limit to branch stack (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Support the 4 new OMR MSRs introduced in DMR and NVL (Michael Petlan) [RHEL-115121] +- perf/x86/intel: Add a check for dynamic constraints (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Disable PMI for self-reloaded ACR events (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Optimize PEBS extended config (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Always reprogram ACR events to prevent stale masks (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Improve validation and configuration of ACR masks (Anubhav Shelat) [RHEL-45125] {CVE-2026-53370} +- perf/x86: Fix potential bad container_of in intel_pmu_hw_config (Anubhav Shelat) [RHEL-45125] {CVE-2026-31782} +- perf/x86/intel: Fix IA32_PMC_x_CFG_B MSRs access error (Anubhav Shelat) [RHEL-45125] {CVE-2025-40122} +- perf/x86/intel: Fix incorrect MSR index calculations in intel_pmu_config_acr() (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Use early_initcall() to hook bts_init() (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Fix and clean up intel_pmu_drain_arch_pebs() type use (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Add counter group support for arch-PEBS (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Setup PEBS data configuration and enable legacy groups (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Update dyn_constraint base on PEBS event precise level (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Allocate arch-PEBS buffer and initialize PEBS_BASE MSR (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Process arch-PEBS records or record fragments (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Factor out PEBS group processing code to functions (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Allow to update user space GPRs from PEBS records (Anubhav Shelat) [RHEL-45125] +- perf/core: Check sample_type in perf_sample_save_callchain (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Remove redundant assignments to sample.period (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/ds: Factor out PEBS record processing code to functions (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Initialize architectural PEBS (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Introduce pairs of PEBS static calls (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Parse CPUID archPerfmonExt leaves for non-hybrid CPUs (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Rename x86_pmu.pebs to x86_pmu.ds_pebs (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Decouple BTS initialization from PEBS initialization (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Fix ARCH_PERFMON_NUM_COUNTER_LEAF (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Correct large PEBS flag check (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Replace x86_pmu.drain_pebs calling with static call (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Support auto counter reload (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Use better start period for frequency mode (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Add CPUID enumeration for the auto counter reload (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel: Track the num of events needs late setup (Anubhav Shelat) [RHEL-45125] +- perf/x86: Add dynamic constraint (Anubhav Shelat) [RHEL-45125] +- perf/x86/intel/uncore: Convert comma to semicolon (Michael Petlan) [RHEL-117338] +- perf/x86/intel/uncore: Add Nova Lake support (Michael Petlan) [RHEL-117338] +- perf/x86/intel/uncore: Add missing PMON units for Panther Lake (Michael Petlan) [RHEL-115125] +- perf pmu: Relax uncore wildcard matching to allow numeric suffix (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Update DMR uncore constraints preliminarily (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support uncore constraint ranges (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support IIO free-running counters on DMR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add freerunning event descriptor helper macro (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SPR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on ICX (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Fix the scale of IIO free running counters on SNR (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add domain global init callback (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add CBB PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Add IMH PMON support for Diamond Rapids (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Remove has_generic_discovery_table() (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Support per-platform discovery base devices (Michael Petlan) [RHEL-115125] +- perf/x86/intel/uncore: Move uncore discovery init struct to header (Michael Petlan) [RHEL-115125] +- perf/x86/intel/cstate: Add Diamond Rapids support (Michael Petlan) [RHEL-115123] +- perf/x86/intel/cstate: Add Nova Lake support (Michael Petlan) [RHEL-120358] +- perf/x86/intel/cstate: Add Wildcat Lake support (Michael Petlan) [RHEL-95669] + +* Tue Aug 18 2026 CKI KWF Bot [5.14.0-739.el9] +- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668] +- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560} +- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370} +- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838] +- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838] +- posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838] +- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557} +- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556] +- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556] +- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991} +- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191} +- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048} +- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324} +- iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325} +- iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932] +- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329} +- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220} +- iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253} +- iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932] +- iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932] +- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932] +- iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932] +- iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932] +- iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932] +- iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289} +- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164} +- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290} +- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932] +- iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932] +- iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591} +- dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932] +- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932] +- iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932] +- iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291} +- iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932] +- drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932] +- iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932] +- iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283} +- iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932] +- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293} +- iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932] +- iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053} +- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372} +- iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932] +- dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932] +- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932] +- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932] +- iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932] +- iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932] +- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122} +- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932] +- dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921] +- dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921] +- dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921] +- dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921] +- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501} + +* Mon Aug 17 2026 CKI KWF Bot [5.14.0-738.el9] +- scsi: smartpqi: Update version to 2.1.42-011 (Don Brace) [RHEL-224339] +- scsi: smartpqi: Add new PCI device-ids (Don Brace) [RHEL-224339] +- scsi: smartpqi: Add support for CCISS_BIG_PASSTHRU ioctl (Don Brace) [RHEL-224339] +- scsi: smartpqi: Fix AIO retry marker cleared by SCSI core between dispatches. (Don Brace) [RHEL-224339] +- scsi: target: Fix hexadecimal CHAP_I handling (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886} +- scsi: target: iscsi: Validate CHAP_R length before base64 decode (CKI Backport Bot) [RHEL-231655] {CVE-2026-63886} +- platform/x86/intel/tpmi/plr: Prevent fault during unbind (Dennis Chen) [RHEL-212707] +- platform/x86: intel: Add notifiers support (Dennis Chen) [RHEL-212707] +- x86/fpu: Ensure XFD state on signal delivery (Dennis Chen) [RHEL-212652] +- platform/x86/intel/vsec: Fix enable_cnt imbalance on PCIe error recovery (Dennis Chen) [RHEL-212719] +- ALSA: hda/realtek: Add quirk for TongFang X6SP45xU (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: ps: disable MSI on resume in ACP PCI driver (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/tas2781: Fix device-0 reset issue and handle -EXDEV in block data processing (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/tas2781: Cancel async firmware request at unbind (Jaroslav Kysela) [RHEL-193254] +- firmware_loader: Add cancel helper for async requests (Jaroslav Kysela) [RHEL-193254] +- ALSA: scarlett2: Update offsets for 2i2 Gen 4 firmware 2417 (Jaroslav Kysela) [RHEL-193254] +- ALSA: scarlett2: Allow selecting config_set by firmware version (Jaroslav Kysela) [RHEL-193254] +- ASoC: qcom: q6apm: fix NULL pointer dereference in graph_callback (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Fix heap overflow in bytes_ext put/get (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: topology: fix memory leak in snd_sof_load_topology (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: topology: validate vendor array size before parsing (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Fix TOCTOU in bytes_put and bytes_get (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc3-control: Use overflow checks in control_update size calc (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc4-control: Validate notification payload size (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: ipc4-control: Fix TOCTOU in sof_ipc4_bytes_put (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: lpass-va-macro: Fix LPASS Codec Version for SC7280 (Jaroslav Kysela) [RHEL-193254] +- ALSA: FCP: Fix NULL pointer dereference in interface lookup (Jaroslav Kysela) [RHEL-193254] +- ASoC: fsl_asrc_dma: fix eDMA maxburst misalignment with channel count (Jaroslav Kysela) [RHEL-193254] +- ASoC: SDCA: Validate written enum value in ge_put_enum_double() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Kill MIDI 2.0 URBs before freeing endpoints (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: clear opened when stream enable fails (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: reject stream disable with no active interface (Jaroslav Kysela) [RHEL-193254] +- ASoC: tlv320aic3x: restrict CLKDIV bypass Q values in dual-rate mode (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Free sideband sg_table objects (Jaroslav Kysela) [RHEL-193254] +- soundwire: intel_ace2x: release bpt_stream when close it (Jaroslav Kysela) [RHEL-193254] +- soundwire: fix bug in sdw_add_element_group_count found by syzkaller (Jaroslav Kysela) [RHEL-193254] +- soundwire: don't program SDW_SCP_BUSCLOCK_SCALE on a unattached Peripheral (Jaroslav Kysela) [RHEL-193254] +- mfd: cs42l43: Sanity check firmware size (Jaroslav Kysela) [RHEL-193254] +- ALSA: core: Fix unintuitive behavior of snd_power_ref_and_wait() (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: avoid stale FIFO cells during resize (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: oss: Serialize readq reset state with q->lock (Jaroslav Kysela) [RHEL-193254] +- ASoC: adau1372: Clear PLL_EN on failed PLL lock without reset GPIO (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Fix kernel heap address leak in bounce_error_event() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Guard sideband endpoint removal (Jaroslav Kysela) [RHEL-193254] +- ASoC: topology: Check PCM and DAI name strings before use (Jaroslav Kysela) [RHEL-193254] +- ASoC: tegra: tegra210_ahub: Validate written enum value (Jaroslav Kysela) [RHEL-193254] +- ASoC: fsl: fsl_audmix: Validate written enum values (Jaroslav Kysela) [RHEL-193254] +- ASoC: meson: aiu: Validate written enum values (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: hdac_hdmi: Validate written enum value (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: Intel: hda-sdw-bpt: select SND_SOF_SOF_HDA_SDW_BPT properly (Jaroslav Kysela) [RHEL-193254] +- ASoC: SOF: Intel: select SND_SOC_SDW_UTILS=y from SND_SOC_SOF_HDA_GENERIC=y (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Fix wrong error test on simple_write_to_buffer() (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Fix possible uninitialized value in cs35l56_spi_system_reset() (Jaroslav Kysela) [RHEL-193254] +- ASoC: cs35l56: Don't leave parent IRQ disabled if system_suspend fails (Jaroslav Kysela) [RHEL-193254] +- ASoC: codecs: aw88261: fix incorrect masks for boost regs (Jaroslav Kysela) [RHEL-193254] +- ASoC: sma1307: Fix uevent string leaks in fault worker (Jaroslav Kysela) [RHEL-193254] +- ALSA: aloop: Drop superfluous break (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: acp-sdw-sof: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254] +- ASoC: amd: acp-sdw-legacy: Bound DAI link iteration (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Clear variable event pointer on read (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: Fix partial userptr event expansion (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: fix Kconfig dependency of HD Audio PCI (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: qcom: Initialize offload control return value (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: midi: Serialize output teardown with event_input (Jaroslav Kysela) [RHEL-193254] +- ALSA: seq: oss: Fix UAF at handling events with embedded SysEx data (Jaroslav Kysela) [RHEL-193254] +- ALSA: xen-front: Connect event channel after stream prepare (Jaroslav Kysela) [RHEL-193254] +- ALSA: xen-front: Reset event channel state on stream clear (Jaroslav Kysela) [RHEL-193254] +- ASoC: dapm: Fix widget lookup with prefixed names across DAPM contexts (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/realtek: Fix speakers on Legion Pro 7 16ARX8H with codec SSID 17aa:38a7 (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: Fix cached processing coefficient verbs (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda: conexant: Remove mic bias threshold override (Jaroslav Kysela) [RHEL-193254] +- ALSA: hda/realtek: Add quirk for TongFang X6xx45xU (Jaroslav Kysela) [RHEL-193254] +- ALSA: doc: usb-audio: Add doc for QUIRK_FLAG_IFB_SILENCE_ON_EMPTY (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Update US-16x08 EQ/comp shadow state after successful writes (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Update Babyface Pro control caches only after successful writes (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Roll back quirk control caches on write errors (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Propagate US-16x08 write errors in route/mix EQ-switch put callbacks (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: Propagate errors in scarlett_ctl_enum_put() (Jaroslav Kysela) [RHEL-193254] +- ALSA: usb-audio: avoid kobject path lookup in DualSense match (Jaroslav Kysela) [RHEL-193254] {CVE-2026-64478} +- ALSA: usb-audio: add IFB_SILENCE_ON_EMPTY quirk for Behringer Flow 8 (Jaroslav Kysela) [RHEL-193254] +- KVM: s390: Fall back to short-term pinning in MAP ioctl (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Introducing kvm_arch_set_irq_inatomic fast inject (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Enable adapter_indicators_set to use mapped pages (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: Add map/unmap ioctl and clean mappings post-guest (Christoph Schlameuss) [RHEL-136457] +- KVM: s390: get rid of gmap_translate() (Christoph Schlameuss) [RHEL-136457] +- selftests: nft_queue.sh: add a parallel stress test (Florian Westphal) [RHEL-150728] +- kselftest: add test for nfqueue induced conntrack race (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: avoid flakes on debug kernels (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: fix spurious timeout on debug kernel (Florian Westphal) [RHEL-150728] +- selftests: netfilter: nft_queue.sh: reduce test file size for debug build (Florian Westphal) [RHEL-150728] +- netfilter: nfnetlink_queue: make hash table per queue (Florian Westphal) [RHEL-150728] {CVE-2026-43084} +- netfilter: nfnetlink_queue: optimize verdict lookup with hash table (Florian Westphal) [RHEL-150728] +- netfilter: nfnetlink_queue: nfqnl_instance GFP_ATOMIC -> GFP_KERNEL_ACCOUNT allocation (Florian Westphal) [RHEL-150728] +- ipv6: fix a BUG in rt6_get_pcpu_route() under PREEMPT_RT (Luis Claudio R. Goncalves) [RHEL-186591] +- netfilter: nat: use kfree_rcu to release ops (Florian Westphal) [RHEL-188519] {CVE-2026-53000} +- kernel.spec.template: add tcp_ao kselftests (Davide Caratti) [RHEL-142637] +- Kconfig: enable CONFIG_TCP_AO (Davide Caratti) [RHEL-142637] +- tcp: Decrement tcp_md5_needed static branch (Davide Caratti) [RHEL-142637] +- net/tcp-ao: fix use-after-free of key in del_async path (Davide Caratti) [RHEL-142637] +- sockptr: fix usize check in copy_struct_from_sockptr() for user pointers (Davide Caratti) [RHEL-142637] +- tcp: defer md5sig_info kfree past RCU grace period in tcp_connect (Davide Caratti) [RHEL-142637] +- tcp: restore RCU grace period in tcp_ao_destroy_sock (Davide Caratti) [RHEL-142637] +- selftests/net: Synchronize client/server before counters checks (Davide Caratti) [RHEL-142637] +- selftests/net: Fix various spelling mistakes in TCP-AO tests (Davide Caratti) [RHEL-142637] +- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Printing fixes to confirm with format-security (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Fix fscanf() call for format-security (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Zero-init tcp_ao_info_opt (Davide Caratti) [RHEL-142637] +- selftests/net: Amend per-netns counter checks (Davide Caratti) [RHEL-142637] +- selftests/tcp_ao: Make RST tests less flaky (Davide Caratti) [RHEL-142637] +- selftests/net: Repair RST passive reset selftest (Davide Caratti) [RHEL-142637] +- tcp: Don't flag tcp_sk(sk)->rx_opt.saw_unknown for TCP AO. (Davide Caratti) [RHEL-142637] +- tcp: Don't access uninit tcp_rsk(req)->ao_keyid in tcp_create_openreq_child(). (Davide Caratti) [RHEL-142637] +- net/tcp: Fix socket memory leak in TCP-AO failure handling for IPv6 (Davide Caratti) [RHEL-142637] {CVE-2025-39852} +- selftests/net: Rectify key counters checks (Davide Caratti) [RHEL-142637] +- selftests/net: Argument value mismatch when calling verify_counters() (Davide Caratti) [RHEL-142637] +- selftests: tcp_ao: set the timeout to 2 minutes (Davide Caratti) [RHEL-142637] +- selftests: tcp_ao: add a config file (Davide Caratti) [RHEL-142637] +- selftests/net/tcp-ao: Use LDLIBS instead of LDFLAGS (Davide Caratti) [RHEL-142637] +- net/tcp_sigpool: Use kref_get_unless_zero() (Davide Caratti) [RHEL-142637] +- selftest/tcp-ao: Rectify out-of-tree build (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO key-management test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO selfconnect/simultaneous connect test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO RST test (Davide Caratti) [RHEL-142637] +- selftests/net: Add SEQ number extension test (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP_REPAIR TCP-AO tests (Davide Caratti) [RHEL-142637] +- selftests/net: Add test/benchmark for removing MKTs (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO + TCP-MD5 + no sign listen socket tests (Davide Caratti) [RHEL-142637] +- selftests/net: Add test for TCP-AO add setsockopt() command (Davide Caratti) [RHEL-142637] +- selftests/net: Add a test for TCP-AO keys matching (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO ICMPs accept test (Davide Caratti) [RHEL-142637] +- selftests/net: Verify that TCP-AO complies with ignoring ICMPs (Davide Caratti) [RHEL-142637] +- selftests/net: Add TCP-AO library (Davide Caratti) [RHEL-142637] +- net/tcp-ao: Fix MAC comparison to be constant-time (Davide Caratti) [RHEL-142637] {CVE-2026-43384} +- net/tcp: Fix a NULL pointer dereference when using TCP-AO with TCP_REPAIR (Davide Caratti) [RHEL-142637] {CVE-2025-39950} +- tcp: Free TCP-AO/TCP-MD5 info/keys without RCU (Davide Caratti) [RHEL-142637] +- tcp: Destroy TCP-AO, TCP-MD5 keys in .sk_destruct() (Davide Caratti) [RHEL-142637] +- net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals (Davide Caratti) [RHEL-142637] +- net/tcp: Disable TCP-AO static key after RCU grace period (Davide Caratti) [RHEL-142637] {CVE-2024-43887} +- net/tcp_ao: Don't leak ao_info on error-path (Davide Caratti) [RHEL-142637] {CVE-2024-40985} +- Documentation/tcp-ao: Add a few lines on tracepoints (Davide Caratti) [RHEL-142637] +- net/tcp: Remove tcp_hash_fail() (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp-md5 and tcp-ao tracepoints (Davide Caratti) [RHEL-142637] +- net/tcp: Move tcp_inbound_hash() from headers (Davide Caratti) [RHEL-142637] +- net/tcp: Add a helper tcp_ao_hdr_maclen() (Davide Caratti) [RHEL-142637] +- net/tcp: Use static_branch_tcp_{md5,ao} to drop ifdefs (Davide Caratti) [RHEL-142637] +- net/tcp: Only produce AO/MD5 logs if there are any keys (Davide Caratti) [RHEL-142637] +- tcp: Move TCP-AO bits from cookie_v[46]_check() to tcp_ao_syncookie(). (Davide Caratti) [RHEL-142637] +- tcp: Cache sock_net(sk) in cookie_v[46]_check(). (Davide Caratti) [RHEL-142637] +- net/tcp: Don't consider TCP_CLOSE in TCP_AO_ESTABLISHED (Davide Caratti) [RHEL-142637] +- tcp: Fix Use-After-Free in tcp_ao_connect_init (Davide Caratti) [RHEL-142637] {CVE-2024-27394} +- net: tcp: remove call to obsolete crypto_ahash_alignmask() (Davide Caratti) [RHEL-142637] +- net/tcp: Don't store TCP-AO maclen on reqsk (Davide Caratti) [RHEL-142637] +- net/tcp: Don't add key with non-matching VRF on connected sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Limit TCP_AO_REPAIR to non-listen sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Consistently align TCP-AO option in the header (Davide Caratti) [RHEL-142637] +- tcp: Fix SYN option room calculation for TCP-AO. (Davide Caratti) [RHEL-142637] +- Documentation/tcp: Fix an obvious typo (Davide Caratti) [RHEL-142637] +- tcp: Fix -Wc23-extensions in tcp_options_write() (Davide Caratti) [RHEL-142637] +- net/tcp_sigpool: Fix some off by one bugs (Davide Caratti) [RHEL-142637] +- net/tcp: fix possible out-of-bounds reads in tcp_hash_fail() (Davide Caratti) [RHEL-142637] +- Documentation/tcp: Add TCP-AO documentation (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP_AO_REPAIR (Davide Caratti) [RHEL-142637] +- net/tcp: Wire up l3index to TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Add static_key for TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Allow asynchronous delete for TCP-AO keys (MKTs) (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO getsockopt()s (Davide Caratti) [RHEL-142637] +- net/tcp: Add option for TCP-AO to (not) hash header (Davide Caratti) [RHEL-142637] +- net/tcp: Ignore specific ICMPs for TCP-AO connections (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp_hash_fail() ratelimited logs (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO SNE support (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO segments counters (Davide Caratti) [RHEL-142637] +- net/tcp: Verify inbound TCP-AO signed segments (Davide Caratti) [RHEL-142637] +- net/tcp: Sign SYN-ACK segments with TCP-AO (Davide Caratti) [RHEL-142637] +- net/tcp: Wire TCP-AO to request sockets (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO sign to twsk (Davide Caratti) [RHEL-142637] +- net/tcp: Add AO sign to RST packets (Davide Caratti) [RHEL-142637] +- net/tcp: Add tcp_parse_auth_options() (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO sign to outgoing packets (Davide Caratti) [RHEL-142637] +- net/tcp: Calculate TCP-AO traffic keys (Davide Caratti) [RHEL-142637] +- net/tcp: Prevent TCP-MD5 with TCP-AO being set (Davide Caratti) [RHEL-142637] +- net/tcp: Introduce TCP_AO setsockopt()s (Davide Caratti) [RHEL-142637] +- net/tcp: Add TCP-AO config and structures (Davide Caratti) [RHEL-142637] +- net/tcp: Prepare tcp_md5sig_pool for TCP-AO (Davide Caratti) [RHEL-142637] +- tcp: Update stale comment for MD5 in tcp_parse_options(). (Davide Caratti) [RHEL-142637] +- tcp: Disable header prediction for MD5 flow. (Davide Caratti) [RHEL-142637] +- tcp: use 2-arg optimal variant of kfree_rcu() (Davide Caratti) [RHEL-142637] +- net/tcp: Separate initialization of twsk (Davide Caratti) [RHEL-142637] +- net/tcp: Do cleanup on tcp_md5_key_copy() failure (Davide Caratti) [RHEL-142637] +- net/tcp: Disable TCP-MD5 static key on tcp_md5sig_info destruction (Davide Caratti) [RHEL-142637] +- net/tcp: Separate tcp_md5sig_info allocation into tcp_md5sig_info_add() (Davide Caratti) [RHEL-142637] +- tcp: md5: Allow MD5SIG_FLAG_IFINDEX with ifindex=0 (Davide Caratti) [RHEL-142637] +- tcp: annotate data-race around tcp_md5sig_pool_populated (Davide Caratti) [RHEL-142637] +- crypto: cipher - On clone do crypto_mod_get() (Davide Caratti) [RHEL-142637] +- crypto: api - Add __crypto_alloc_tfmgfp (Davide Caratti) [RHEL-142637] +- crypto: cmac - Add support for cloning (Davide Caratti) [RHEL-142637] +- crypto: cipher - Add crypto_clone_cipher (Davide Caratti) [RHEL-142637] +- crypto: cmac - Use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637] +- crypto: shash - Allow cloning on algorithms with no init_tfm (Davide Caratti) [RHEL-142637] +- crypto: cryptd - Add support for cloning hashes (Davide Caratti) [RHEL-142637] +- crypto: cryptd - Convert hash to use modern init_tfm/exit_tfm (Davide Caratti) [RHEL-142637] +- crypto: hmac - Add support for cloning (Davide Caratti) [RHEL-142637] +- crypto: hash - Add crypto_clone_ahash/shash (Davide Caratti) [RHEL-142637] +- crypto: api - Add crypto_clone_tfm (Davide Caratti) [RHEL-142637] +- crypto: api - Add crypto_tfm_get (Davide Caratti) [RHEL-142637] +- iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2 (Petr Oros) [RHEL-155154] + +* Thu Aug 13 2026 CKI KWF Bot [5.14.0-737.el9] +- smb: client: fix SMB1 TRANS2 multi-response truncation in SendReceive() (Paulo Alcantara) [RHEL-222675] +- vhost: reset the vring metadata cache on vring reconfiguration (CKI Backport Bot) [RHEL-224537] +- thermal: intel: Fix dangling resources on thermal_throttle_online() failure (David Arcari) [RHEL-212721] +- thermal: intel: int340x: Fix potential shift overflow in ptc_mmio_write() (David Arcari) [RHEL-212721] +- bnxt_en: Fix NULL pointer dereference (CKI Backport Bot) [RHEL-185084] + * Tue Aug 11 2026 CKI KWF Bot [5.14.0-736.el9] - selinux: check connect-related permissions on TCP Fast Open (CKI Backport Bot) [RHEL-222801] - i2c: core: fix adapter deregistration race (David Arcari) [RHEL-222902] {CVE-2026-64279}