264edaecf7
* Tue Aug 18 2026 CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-739.el9]
- mm/vmscan: fix hard LOCKUP in function isolate_lru_folios (Aristeu Rozanski) [RHEL-153668]
- posix-cpu-timers: Prevent UAF caused by non-leader exec() race (Waiman Long) [RHEL-227838] {CVE-2026-64560}
- posix-cpu-timers: Fix pid refcount leak in do_cpu_nanosleep() error path (Waiman Long) [RHEL-227838] {CVE-2026-64370}
- posix-timers: Expand timer_[re]arm() callbacks with a boolean return value (Waiman Long) [RHEL-227838]
- posix-timers: Retrieve interval in common timer_settime() code (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Simplify posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Remove incorrect comment in posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Use @now instead of @val for clarity (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Do not arm SIGEV_NONE timers (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Replace old expiry retrieval in posix_cpu_timer_set() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_set() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Handle SIGEV_NONE timers correctly in timer_get() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Handle interval timers correctly in timer_get() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Save interval only for armed timers (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Split up posix_cpu_timer_get() (Waiman Long) [RHEL-227838]
- posix-cpu-timers: Implement the missing timer_wait_running callback (Waiman Long) [RHEL-227838]
- Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb() (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557}
- Bluetooth: 6lowpan: fix cyclic locking warning on netdev unregister (CKI Backport Bot) [RHEL-231355] {CVE-2026-64557}
- cgroup/psi: Set of->priv to NULL upon file release (Waiman Long) [RHEL-232556]
- sched/psi: Create the psimon kthread outside of cgroup_mutex (Waiman Long) [RHEL-232556]
- sched/psi: fix race between file release and pressure write (Waiman Long) [RHEL-232556] {CVE-2026-52991}
- i2c: stub: Reject I2C block transfers with invalid length (CKI Backport Bot) [RHEL-232106] {CVE-2026-64191}
- net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CKI Backport Bot) [RHEL-230091] {CVE-2026-64048}
- iommu/intel: Fix out-of-bounds memset in dmar_latency_disable() (Eder Zulian) [RHEL-213932] {CVE-2026-68324}
- iommu/amd: Bound the early ACPI HID map (Eder Zulian) [RHEL-213932] {CVE-2026-68325}
- iommu/vt-d: Disallow SVA if page walk is not coherent (Eder Zulian) [RHEL-213932]
- iommu/amd: Wait for completion instead of returning early in iommu_completion_wait() (Eder Zulian) [RHEL-213932] {CVE-2026-68329}
- iommu/amd: serialize sequence allocation under concurrent TLB invalidations (Eder Zulian) [RHEL-213932] {CVE-2026-43220}
- iommu/amd: move wait_on_sem() out of spinlock (Eder Zulian) [RHEL-213932] {CVE-2026-43253}
- iommu/arm-smmu-v3-iommufd: Require exactly one Stream ID for a vDEVICE (Eder Zulian) [RHEL-213932]
- iommufd/viommu: Publish a vDEVICE only after vdevice_init() succeeds (Eder Zulian) [RHEL-213932]
- iommufd/viommu: Release the igroup lock on the vdevice_size error path (Eder Zulian) [RHEL-213932]
- iommufd: Fix wrong hwpt passed to iommufd_auto_response_faults on replace (Eder Zulian) [RHEL-213932]
- iommu/dma-iommu: Fix wrong scatterlist length assignment in P2PDMA path (Eder Zulian) [RHEL-213932]
- iommu/iommufd: Fix IOPF group ownership UAF (Eder Zulian) [RHEL-213932]
- iommu: Avoid copying the user array twice in the full-array copy helper (Eder Zulian) [RHEL-213932]
- iommufd: Set upper bounds on cache invalidation entry_num and entry_len (Eder Zulian) [RHEL-213932] {CVE-2026-64289}
- iommu/dma: Do not try to iommu_map a 0 length region in swiotlb (Eder Zulian) [RHEL-213932] {CVE-2026-53164}
- iommufd: Avoid partial fault group delivery in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932]
- iommufd: Break the loop on failure in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932] {CVE-2026-64290}
- iommufd: Reject invalid read count in iommufd_fault_fops_read() (Eder Zulian) [RHEL-213932]
- iommufd: Propagate allocation failure in iommufd_veventq_deliver_fetch() (Eder Zulian) [RHEL-213932]
- iommufd: Reject invalid read count in iommufd_veventq_fops_read() (Eder Zulian) [RHEL-213932]
- iommufd: Rewind header length in done if iommufd_veventq_fops_read() fails (Eder Zulian) [RHEL-213932]
- iommu/vt-d: Fix RB-tree corruption in probe error path (Eder Zulian) [RHEL-213932]
- iommu/vt-d: Clear Present bit before tearing down scalable-mode context entry (Eder Zulian) [RHEL-213932]
- iommu/vt-d: Avoid WARNING in sva unbind path (Eder Zulian) [RHEL-213932] {CVE-2026-64591}
- dma-debug: fix physical address retrieval in debug_dma_sync_sg_for_device (Eder Zulian) [RHEL-213932]
- dma-mapping: direct: fix missing mapping for THRU_HOST_BRIDGE segments (Eder Zulian) [RHEL-213932]
- iommu/amd: Don't split flush for amd_iommu_domain_flush_all() (Eder Zulian) [RHEL-213932]
- iommufd: Set veventq_depth upper bound (Eder Zulian) [RHEL-213932] {CVE-2026-64291}
- iommufd: Fix data_len byte-count vs element-count mismatch (Eder Zulian) [RHEL-213932]
- drm/tegra: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932]
- gpu: host1x: Fix iommu_map_sgtable() return value check (Eder Zulian) [RHEL-213932]
- iommu/amd: Fix premature break in init_iommu_one() (Eder Zulian) [RHEL-213932]
- iommu/arm-smmu-qcom: Fix fastrpc compatible string in ACTLR client match table (Eder Zulian) [RHEL-213932]
- iommu/vt-d: Disable DMAR for Intel Q35 IGFX (Eder Zulian) [RHEL-213932]
- iommu/amd: Bounds-check devid in __rlookup_amd_iommu() (Eder Zulian) [RHEL-213932] {CVE-2026-53283}
- iommu/amd: Fix a stale comment about which legacy mode is user visible (Eder Zulian) [RHEL-213932]
- iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read (Eder Zulian) [RHEL-213932] {CVE-2026-64293}
- iommufd: Fix a race with concurrent allocation and unmap (Eder Zulian) [RHEL-213932]
- iommu/amd: Fix clone_alias() to use the original device's devid (Eder Zulian) [RHEL-213932] {CVE-2026-53053}
- iommu/vt-d: Block PASID attachment to nested domain with dirty tracking (Eder Zulian) [RHEL-213932] {CVE-2026-53372}
- iommufd: Fix return value of iommufd_fault_fops_write() (Eder Zulian) [RHEL-213932]
- dma-mapping: add missing `inline` for `dma_free_attrs` (Eder Zulian) [RHEL-213932]
- iommu/tegra241-cmdqv: Update uAPI to clarify HYP_OWN requirement (Eder Zulian) [RHEL-213932]
- iommu/tegra241-cmdqv: Set supports_cmd op in tegra241_vcmdq_hw_init() (Eder Zulian) [RHEL-213932]
- iommu/arm-smmu-v3: Add a missing dma_wmb() for hitless STE update (Eder Zulian) [RHEL-213932]
- dma: swiotlb: add KMSAN annotations to swiotlb_bounce() (Eder Zulian) [RHEL-213932]
- iommufd/selftest: Fix page leaks in mock_viommu_{init,destroy} (Eder Zulian) [RHEL-213932]
- iommufd: vfio compatibility extension check for noiommu mode (Eder Zulian) [RHEL-213932]
- iommu/arm-smmu-qcom: do not register driver in probe() (Eder Zulian) [RHEL-213932]
- iommufd/selftest: Check for overflow in IOMMU_TEST_OP_ADD_RESERVED (Eder Zulian) [RHEL-213932] {CVE-2025-71122}
- iommufd/selftest: Make it clearer to gcc that the access is not out of bounds (Eder Zulian) [RHEL-213932]
- dmaengine: tegra: Fix burst size calculation (Eder Zulian) [RHEL-213921]
- dmaengine: Fix possible use after free (Eder Zulian) [RHEL-213921]
- dmaengine: qcom: gpi: set DMA_PRIVATE capability (Eder Zulian) [RHEL-213921]
- dmaengine: imx-sdma: Refine spba bus searching in probe (Eder Zulian) [RHEL-213921]
- ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178418] {CVE-2026-43501}
Resolves: RHEL-153668, RHEL-178418, RHEL-213921, RHEL-213932, RHEL-227838, RHEL-230091, RHEL-231355, RHEL-232106, RHEL-232556
Signed-off-by: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com>
13 MiB
13 MiB
The file is too large to be shown.
View Raw