# changelog

author: Michal Sekletar <msekleta@redhat.com> - 0.8-21
changelog:
  - fix file attributes on /run/avahi-daemon (RHEL-5633)
  - avahi-client: fix resource leak (RHEL-27722)
  - fix resource leak in avahi_time_event_queue_new (RHEL-27717)


author: Kate Hsuan <hpa@redhat.com> - 0.9.10-1
changelog:
  - Update to the upstream version 0.9.10
  - Update to 0.9.10
  - Fix bolt exits when opening an empty version file
  - Fix a NULL syspath variable causes SIGSEGV


author: Jaroslav Škarvada <jskarvad@redhat.com> - 6.1-8
changelog:
  - Dropped explicit brlapi dependency (brltty) and relaxed brltty
    dependency (brlapi)
    Related: rhbz#1765611


author: Kaleb S. KEITHLEY <kkeithle[at]redhat.com> - 2:16.1.0-0.5.snapshot
changelog:
  - ceph 16.1.0 RC (ceph-16.1.0-308-gabe639eb)
  -  rpmbuild apparently unable to automatically derive 'Requires: rocksdb' from 'BuildRequires: rocksdb-devel' for librocksdb.so.6.13


author: Ondrej Kozina <okozina@redhat.com> - 2.4.3-1
changelog:
  - Update to cryptsetup 2.4.3.
  - patch: Fix typo in repair command prompt.
    Resolves: #2022309 #2023316 #2032782


author: Daniel Zatovic <dzatovic@redhat.com> - 2.4.3-5.1
changelog:
  - patch: Run PBKDF benchmark with 8 bytes long well-known passphrase.
  - patch: Change tests to use passphrases with minimal 8 chars length.
  - patch: Add FIPS related error message in keyslot add code.
  - Resolves: #2151576


author: Martin Osvald <mosvald@redhat.com> - 3.4.1-11
changelog:
  - Resolves: RHEL-20925 - Seen/Unseen Flag not working correctly
    for shared mailboxes
  - cyrus-imapd.spec: rename patches to correspond with others


author: José Expósito <jexposit@redhat.com> - 2.4.123-2
changelog:
  - Revert upstream commit ffaa3ce144be ("2.4.122, Build Intel on all arches")
    libpciaccess is not available in RHEL 9 aarch64, ppc64le and s390x
    Resolves: https://issues.redhat.com/browse/RHEL-53869


author: Antonio Murdaca <amurdaca@redhat.com> - 0.5.1-1
changelog:
  * chore: update patch for new release by @nullr0ute in https://github.com/fdo-rs/fido-device-onboard-rs/pull/625
   * chore: fix require error with commitlint by @miabbott in https://github.com/fdo-rs/fido-device-onboard-rs/pull/636
   * fix(license): replace space with - in Apache 2.0 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/632
   * fix(data-formats): use serde_tuple serializer for error messages by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/629
   * fix: cargo test for non-root users by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/635
   * fix(get_current_user_name): remove trailing whitespaces. by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/638
   * chore: bump mio from 0.8.10 to 0.8.11 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/640
   * fix: vendored tarfile creation by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/634
   * fix: static-mut-refs warning by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/651
   * Enable CentOS 9 builds and add Testing Farm e2e tests by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/650
   * Add an OV re-registration window option when using DB storage by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/643
   * chore: bump pem from 2.0.1 to 3.0.3 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/639
   * chore: bump h2 from 0.3.25 to 0.3.26 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/659
   * feat: verify trusted manufacturers by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/656
   * database enhancements by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/666
   * chore: bump openssl to 0.10.66 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/664
   * chore(store): make the store OVs agnostic by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/671
   * feat(manufacturing-server): implement an export OVs endpoint  by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/673
   * fix(systemd-units): run before powering off the system by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/676
   * fix(dracut): use isolate on error in the manufacturing-client service by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/678
   * fix(systemd-generator): write configuration to '/run' by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/677
   * fix(owner-tool): use the new API to export ovs by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/675
   * chore: update diesel to 2.2.3 by @7flying in https://github.com/fdo-rs/fido-device-onboard-rs/pull/669
   * chore: bump reqwest from 0.11.27 to 0.12.7 by @dependabot in https://github.com/fdo-rs/fido-device-onboard-rs/pull/683
   * fix: use centos-stream-9 target instead of epel-9 by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/687
   * enhance onboarding testing by @mmartinv in https://github.com/fdo-rs/fido-device-onboard-rs/pull/681
   * ci: add konflux test cases by @yih-redhat in https://github.com/fdo-rs/fido-device-onboard-rs/pull/688
   * fix(make-vendored-tarfile.sh): exclude idna tests with unicode points by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/692
   * chore: bump for 0.5.1 by @runcom in https://github.com/fdo-rs/fido-device-onboard-rs/pull/693

   * @miabbott made their first contribution in https://github.com/fdo-rs/fido-device-onboard-rs/pull/636
   * @yih-redhat made their first contribution in https://github.com/fdo-rs/fido-device-onboard-rs/pull/688

   **Full Changelog**: https://github.com/fdo-rs/fido-device-onboard-rs/compare/v0.5.0...v0.5.1


author: Kalev Lember <klember@redhat.com> - 1.12.9-2
changelog:
  - Backport upstream patches for CVE-2024-42472
  - Require bubblewrap version that has new --bind-fd option backported for
    addressing CVE-2024-42472


author: Jan Grulich <jgrulich@redhat.com> - 1.12.9-4.1
changelog:
  - Fix arbitrary code execution via crafted symlinks in sandbox-expose options
    Resolves: RHEL-165643
  - Fix arbitrary file deletion on host via improper cache file path validation
    Resolves: RHEL-170171


author: Lukáš Zaoral <lzaoral@redhat.com>- 3.0.4-9
changelog:
  - backport the following fixes from Fedora:
    - fix header conflicts in multilib installs (RHEL-134741)
    - fix rpmlint warnings


author: Adam Jackson <ajax@redhat.com> - 1.3.5-9
changelog:
  - Remove BuildRequires xprop entirely. If present, the configure script will call
    it looking for a property on the root window that Fedora's X server does not
    set, and which would not work anyway since there is no X server running in the
    buildroot, so we can just remove the dependency.


author: Michel Lind <salimma@centosproject.org> - 2.10.4-10
changelog:
  - Fix for CVE-2025-27363 out-of-bound write vulnerability
  - Patch initially by Marc Deslauriers of Canonical
  - https://www.openwall.com/lists/oss-security/2025/03/14/3
  - Adjusted for EL9 by Jonathan Wright of AlmaLinux
  - and a member of the Meta security team
  - Resolves: RHEL-83105


author: Florian Weimer <fweimer@redhat.com> - 11.5.0-10
changelog:
  - Exception handling performance improvements (RHEL-105072)
  - libgcc: Use _dl_find_object to find DWARF data in unwinder
  - libgcc: Use lock-free data structures for run-time unwinder registration


author: David Malcolm <dmalcolm@redhat.com> - 11.5.0-14
changelog:
  - Add backport of upstream r15-8946-g580664d1b66a5d to gcc 11, adding
    branches and calls to gcov output, but not conditions (RHEL-105416).


author: Nick Clifton <nickc@redhat.com> - 10.97-1
changelog:
  - Annocheck: Add test for binaries built by cross compilers.
  - Annocheck: Improve heuristic used to detect binaries without code. (#2144533)


author: Nick Clifton <nickc@redhat.com> - 11.02-1
changelog:
  - Annocheck: Do not assume that object files contain no code simply because they do not have an executable segment.  (#2158386)
  - Annocheck: Add more special glibc filenames.  (#2158100)


author: Nick Clifton <nickc@redhat.com> - 11.05-1
changelog:
  - Annocheck: Fix handling of empty files.  (#2159292)
  - Annocheck: Add crti.o and crtn.o to the list of known glibc special files.  (#2158740)
  - Annocheck: Fix memory leaks.


author: Nick Clifton <nickc@redhat.com> - 11.06-1
changelog:
  - Annocheck: Fix handling of file built by multiple versions of gcc.  (#2160700)
  - Spec file: Enable annotated building.


author: Nick Clifton <nickc@redhat.com> - 12.20-1
changelog:
  - Annocheck: Ignore AArch64 $x and $d symbols.  (#2221192)
  - GCC Plugin: Suppress active checks for fortran sources.  Improve scanning of COLLECT_GCC_OPTIONS.


author: Nick Clifton <nickc@redhat.com> - 12.32-1
changelog:
  - LLVM Plugin: Fix building with LLVM version 17.  (RHEL-17311)
  - GCC Plugin: Add support for -fhardended.
  - Update glibc detection heuristics for PPC64.  (RHEL-16453)
  - Fix another atexit test failure.  (#2247481)
  - Fix atexit test failure.
  - Notes: Add support for string format notes.
  - GCC Plugin: Record settings of -Wstrict-flex-arrays and -fstrict-flex-arrays
  - Annobin: Add future test of these options.
  - GCC Plugin: Record settings of -Wimplicit-int and -Wimplicit-function-declaration.
  - Annobin: Add test for these warnings.
  - GCC Plugin: Enable string note format by default.
  - Annocheck: Change GO FIPS test to look for CGO_ENABLED markers.
  - Annocheck: Add test for FIPS compliant GO binaries.
  - Annocheck: Fix double free.  (#2226749)


author: Nick Clifton <nickc@redhat.com> - 12.32-2
changelog:
  - GCC Plugin: Add %verify tokens to show that the default plugin names are symbolic links. (RHEL-17505)


author: Nick Clifton <nickc@redhat.com> - 12.65-1
changelog:
  - Rebase to 12.65.  (RHEL-51018)
  - Annocheck: Fix recording arguments for later re-use.  (RHEL-50802)
  - GCC Plugin: Fix building AArch64 components with gcc earlier than 11.3.
  - Annocheck: Add improvements to the builtby utility.
  - Annocheck: Add support for ADA binaries.
  - Annocheck: Add support for binaries built from more than two high level source languages.
  - Annocheck: Add support for object files containing no executable code.
  - Annocheck: Do not FAIL LLVM compiled binaries that have not been built with sanitize-cfi and/or sanitize-safe-stack.
  - Annocheck: Add support for Fortran binaries.
  - Annocheck: Add heuristic for detecting parts of the CGO runtime library.
  - Annocheck: Add improvements for handling Clang runtime binaries.
  - Annocheck: Add tweaks for mixed Rust/C binaries.  (#2284605)
  - Annocheck: Add more glibc source file names.
  - Annocheck: Skip GAPS test for GO binaries.  (RHEL-36308)
  - Annocheck: Remove some false positives for Rust binaries.  (#2280239)
  - Annocheck: Defer passing the branch protection test until all notes have been checked.
  - GCC Plugin: Add extra code for detecting the branch protection setting.  (RHEL-35958)


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53574)


author: Nick Clifton <nickc@redhat.com> - 12.92-1
changelog:
  - Rebase to bring in improvements for locating string notes.  (RHEL-79807)
  - Annocheck: Do not rely upon libelf's ability to detect links to separate debuginfo files.  (RHEL-79264)
  - Annocheck: Fix resource leak.  (RHEL-79253)
  - Annocheck: Fix double free. Add special handling for COMBOOT modules.
  - Annocheck: Improve diagnostics when a separate debug info file cannot be found.
  - Annocheck: Look for -fstack-clash-protection in DW_AT_producer string.  (RHEL-77328)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Nick Clifton <nickc@redhat.com> - 12.67-1
changelog:
  - Annocheck: Stop spurious assembler warnings.  (RHEL-53213)
  - Annocheck: Stop warnings about known gaps.    (RHEL-53218)
  - Annocheck: Fix stack realign test.  (#2302427)


author: Nick Clifton <nickc@redhat.com> - 12.67-2
changelog:
  - Spec File: Use correct directory for plugin installation.  (RHEL-53209)
  - Spec File: Disable plugin when running on wrong major version of the compiler.


author: Nick Clifton <nickc@redhat.com> - 12.69-1
changelog:
  - BuiltBy: Fix seg-fault when comparing language version strings.  (RHEL-53497)
  - Spec File: Use correct names for the symlinks.  (RHEL-53209)


author: Nick Clifton <nickc@redhat.com> - 12.87-1
changelog:
  - Rebase for GTS 14.1 release.  (RHEL-76932)
  - Annocheck: Fix locating string notes (again).  Add exception for glibc benchmark tests.  (RHEL-76456)
  - Annocheck: Add crtoffloadtableS.o to list of known gcc binaries.  (RHEL-760404)
  - Annocheck: Fix the --debug-dir option.
  - Annocheck: Fix corrupt warning message when unable to locate separate debug info files.
  - Annocheck: Remove spurious debugging messages.
  - Annocheck: Always look for annobin notes in separate debug info files.  (RHEL-75778)
  - Annocheck: Support multiple --debug-rpm and --debug-file options.  (RHEL-73349)
  - Annocheck: Add support for sys-root'ed glibc packages.  (RHEL-71296)
  - GCC Plugin: Tidy up use of gcc's diagnoatic headers.  (#32429)
  - Testsuite: Use configured compiler when running tests.
  - GCC Plugin: Fix building with gcc 15.  (#32429)
  - Annocheck: Fix overly long debug messages.
  - Annocheck: Rename rwx-seg test to load-segments.  Add more checks.  Add check for gaps as a future fail.
  - Annocheck: Add --no-allow-excpetions to disable exceptions for known special binaries.
  - Annocheck: Add --enable-future to enable future fail components in normal tests.
  - Annocheck: Fix bug preventing the inclusion of the rpm name in reports.
  - Annocheck: Add more exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Add --skip-passes option.
  - Annocheck: Add exceptions for gcc binaries.  (RHEL-33365)
  - Annocheck: Skip property note test for i386 binaries created by LLVM.  (#2323797)
  - Annocheck: Skip FORTIFY and GLIBC_ASSERTIONS tests for LLVM produced binaries with unparseable DW_AT_producer attributes in their DWARF debug info.  (RHEL-65411)
  - GCC Plugin: Change type of the .annobin.notes section from SHT_STRTAB to SHT_PROGBITS.


author: Filip Januš <fjanus@redhat.com> - 2.2.5-12
changelog:
  - Add patch(gd-2.2.5-null-pointer.patch) - fix Null pointer reference in gdImageClone (gdImagePtr src)
  - Resolves: #1599032


author: Filip Januš <fjanus@redhat.com> - 2.3.1-1
changelog:
  - Upstream released new version 2.3.1
  - patch bug615 is no more needed - fixed by upstream in release
  - gdimagestring16/gdimagestring16 gdimagestringup16/gdimagestringup16 passed on
    x390s - XFAIL_TEST definition for x390s is no more necessary


author: Filip Januš <fjanus@redhat.com> - 2.3.2-1
changelog:
  - Add condition if fedora for packages not available in RHEL
  - enable avif support
  - use bcond
  - rebase to version 2.3.2


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-16
changelog:
  - RHEL-38839 CVE-2024-33871 ghostscript: OPVP device arbitrary code execution via custom Driver library


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-17
changelog:
  - RHEL-44759 CVE-2024-33870 ghostscript: path traversal to arbitrary files if the current directory is in the permitted paths
  - RHEL-44745 CVE-2024-33869 ghostscript: path traversal and command execution due to path reduction
  - RHEL-44731 CVE-2024-29510 ghostscript: format string injection leads to shell command execution (SAFER bypass)


author: Zdenek Dohnal <zdohnal@redhat.com> - 9.54.0-18
changelog:
  - RHEL-18397 CVE-2023-46751 ghostscript: dangling pointer in gdev_prn_open_printer_seekable()
  - RHEL-67048 CVE-2024-46951 ghostscript: Arbitrary Code Execution in Artifex Ghostscript Pattern Color Space
  - RHEL-67053 CVE-2024-46954 ghostscript: Directory Traversal in Ghostscript via Overlong UTF-8 Encoding
  - RHEL-67053 CVE-2024-46953 ghostscript: Path Traversal and Code Execution via Integer Overflow in Ghostscript
  - RHEL-67053 CVE-2024-46956 ghostscript: Out-of-Bounds Data Access in Ghostscript Leads to Arbitrary Code Execution


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-2
changelog:
  - fix CVE-2025-10920
  - fix CVE-2025-10921
  - fix CVE-2025-10922
  - fix CVE-2025-10923
  - fix CVE-2025-10924
  - fix CVE-2025-10925
  - fix CVE-2025-10934


author: Josef Ridky <jridky@redhat.com> - 2:3.0.4-4.4
changelog:
  - fix CVE-2026-4150 - align with Y-stream
  - fix CVE-2026-4151
  - fix CVE-2026-4152
  - fix CVE-2026-4153
  - fix CVE-2026-4154
  - fix CVE-2026-4887


author: Milan Crha <mcrha@redhat.com> - 41.0-2
changelog:
  - Resolves: #2012699 (Backport changes from Fedora 35)
  - Add patch to mark compulsory only repos, not apps from it
  - Resolves: #2011176 (flathub repo can't be added through gnome-software)
  - Resolves: #2010660 (gs-repos-dialog: Can show also desktop applications)
  - Resolves: #2010353 (Optional repos cannot be disabled)
  - Resolves: #2010740 (Refresh on repository setup change)
  - Resolves: #2009063 (Correct update notifications)


author: Milan Crha <mcrha@redhat.com> - 41.5-2
changelog:
  - Resolves: #2128812 (Correct property name in GsRemovalDialog .ui file)
  - Resolves: #2129021 (Hide some errors in non-debug builds)


author: Wim Taymans <wtaymans@redhat.com> - 1.22.12-4
changelog:
  - Apply patches for CVE-2024-47537, CVE-2024-47539, CVE-2024-47540
    CVE-2024-47543, CVE-2024-47544, CVE-2024-47545, CVE-2024-47546,
    CVE-2024-47596, CVE-2024-47597, CVE-2024-47598, CVE-2024-47599,
    CVE-2024-47601, CVE-2024-47602, CVE-2024-47603, CVE-2024-47606,
    CVE-2024-47613, CVE-2024-47774, CVE-2024-47775, CVE-2024-47776,
    CVE-2024-47777, CVE-2024-47778, CVE-2024-47834
  - Resolves: RHEL-70958, RHEL-70971, RHEL-71033, RHEL-71195
  - Resolves: RHEL-71210, RHEL-71202, RHEL-71171, RHEL-71200
  - Resolves: RHEL-71206, RHEL-71173, RHEL-71198, RHEL-71204
  - Resolves: RHEL-71208, RHEL-71031, RHEL-71007, RHEL-71039
  - Resolves: RHEL-71169, RHEL-71192, RHEL-71161, RHEL-71167
  - Resolves: RHEL-71189


author: Tomas Pelka <tpelka@redhat.com> - 1.22.12-7.1
changelog:
  - Rebase rhel-9.8.0 from 1.18.4 to 1.22.12 to resync with rhel-9.7.0/c9s
    (this branch had regressed to a stale pre-1.22.12 base)
    Resolves: RHEL-156269, RHEL-156270
  - Fix CVE-2026-53705: integer overflow in wavpack decoder, re-applied
    on top of the correct 1.22.12 base
    Resolves: RHEL-184477


author: Tom Stellard <tstellar@redhat.com> - 5.3.3-3
changelog:
  - Fix warning building with clang
  - non-void function 'stp_paths_copy_with_prefix' should return a value [-Wreturn-type]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.6.1.el9_8]
changelog:
  - nfsd: fix heap overflow in NFSv4.0 LOCK replay cache (Scott Mayhew) [RHEL-167017] {CVE-2026-31402}
  - scsi: qla2xxx: Fix improper freeing of purex item (CKI Backport Bot) [RHEL-159223] {CVE-2025-68741}
  - smb: client: fix krb5 mount with username option (Paulo Alcantara) [RHEL-158988]
  - ionic: fix persistent MAC address override on PF (Mohammad Heib) [RHEL-151378]
  - RDMA/bnxt_re: convert timeouts to secs_to_jiffies() (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix return code of bnxt_re_configure_cc (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix missing error handling for tx_queue (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix incorrect display of inactivity_cp in debugfs output (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix the condition check while programming congestion control (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix buffer overflow in debugfs code (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Congestion control settings using debugfs hook (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Use macro instead of hard coded value (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support 2G message size (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Fix size of uverbs_copy_to() in BNXT_RE_METHOD_GET_TOGGLE_MEM (CKI Backport Bot) [RHEL-155966]
  - RDMA/bnxt_re: Support extended stats for Thor2 VF (CKI Backport Bot) [RHEL-155966]
  - net: hv_netvsc: reject RSS hash key programming without RX indirection table (Medha Mummigatti) [RHEL-155207]
  - ice: fix page leak for zero-size Rx descriptors (CKI Backport Bot) [RHEL-154095]
  - net/sched: sch_cake: Fix incorrect qlen reduction in cake_drop (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - net/sched: Make cake_enqueue return NET_XMIT_CN when past buffer_limit (Davide Caratti) [RHEL-150444] {CVE-2025-39766}
  - rtnetlink: Allocate vfinfo size for VF GUIDs when supported (Kamal Heib) [RHEL-145522] {CVE-2025-22075}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.7.1.el9_8]
changelog:
  - KVM: x86/mmu: Drop/zap existing present SPTE even when creating an MMIO SPTE (Paolo Bonzini) [RHEL-153722] {CVE-2026-23401}
  - powerpc/tools: drop `-o pipefail` in gcc check scripts (Jan Stancek) [RHEL-165125]
  - libceph: reset sparse-read state in osd_fault() (CKI Backport Bot) [RHEL-169078] {CVE-2026-23136}
  - libceph: replace overzealous BUG_ON in osdmap_apply_incremental() (CKI Backport Bot) [RHEL-169071] {CVE-2026-22990}
  - libceph: prevent potential out-of-bounds reads in handle_auth_done() (CKI Backport Bot) [RHEL-169067] {CVE-2026-22984}
  - libceph: make decode_pool() more resilient against corrupted osdmaps (CKI Backport Bot) [RHEL-169063] {CVE-2025-71116}
  - scsi: lpfc: avoid crashing in lpfc_nlp_get() if lpfc_nodelist was freed (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise logging format for failed CT MIB requests" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update debugfs trace ring initialization messages" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check for hdwq null ptr when cleaning up lpfc_vport structure" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Skip RSCN processing when FC_UNLOADING flag is set" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Early return out of FDMI cmpl for locally rejected statuses" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Simplify error handling for failed lpfc_get_sli4_parameters cmd" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Relocate clearing initial phba flags from link up to link down hdlr" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure HBA_SETUP flag is used only for SLI4 in dev_loss_tmo_callbk" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Move clearing of HBA_SETUP flag to before lpfc_sli4_queue_unset" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise CQ_CREATE_SET mailbox bitfield definitions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify end-of-life adapters' model descriptions" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.10 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.10" (Ewan D. Milne) [RHEL-167742]
  - Revert "lpfc: don't use file->f_path.dentry for comparisons" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix wrong function reference in a comment" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: use min() to improve code" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use int type to store negative error codes" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove unused member variables in struct lpfc_hba and lpfc_vport" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Abort outstanding ELS WQEs regardless of if rmmod is in progress" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up allocated queues when queue setup mbox commands fail" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove ndlp kref decrement clause for F_Port_Ctrl in lpfc_cleanup" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Decrement ndlp kref after FDISC retries exhausted" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Check return status of lpfc_reset_flush_io_context during TGT_RESET" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure PLOGI_ACC is sent prior to PRLI in Point to Point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Define size of debugfs entry for xri rebalancing" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix memory leak when nvmeio_trc debugfs entry is used" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Use switch case statements in DIF debugfs handlers" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Clean up extraneous phba dentries" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Convert debugfs directory counts from atomic to unsigned int" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.11" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Copyright updates for 14.4.0.11 patches" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update various NPIV diagnostic log messaging" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Revise discovery related function headers and comments" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Remove redundant NULL ptr assignment in lpfc_els_free_iocb()" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Ensure unregistration of rpis for received PLOGIs" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Fix leaked ndlp krefs when in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Modify kref handling for Fabric Controller ndlps" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Allow support for BB credit recovery in point-to-point topology" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Add capability to register Platform Name ID to fabric" (Ewan D. Milne) [RHEL-167742]
  - Revert "scsi: lpfc: Update lpfc version to 14.4.0.12" (Ewan D. Milne) [RHEL-167742]
  - drm/i915/dp: Fix panel replay when DSC is enabled (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Recompute all MST link CRTCs if DSC gets enabled on the link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Track DSC enabled status on the MST link (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp_mst: Reuse the DP-SST helper function to compute FEC config (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Export helper to determine if FEC on non-UHBR links is required (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dp: Ensure the FEC state stays disabled for UHBR links (Anusha Srivatsa) [RHEL-104822]
  - drm/i915/dsc: Add helper to enable the DSC configuration for a CRTC (Anusha Srivatsa) [RHEL-104822]
  - x86/boot: Handle relative CONFIG_EFI_SBAT_FILE file paths (Oleksii Baranov) [RHEL-157853]
  - net/sched: Only allow act_ct to bind to clsact/ingress qdiscs and shared blocks (CKI Backport Bot) [RHEL-157235] {CVE-2026-23270}
  - net/sched: cls_u32: use skb_header_pointer_careful() (Paolo Abeni) [RHEL-150404] {CVE-2026-23204}
  - net: add skb_header_pointer_careful() helper (Paolo Abeni) [RHEL-150404]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.8.1.el9_8]
changelog:
  - crypto: algif_aead - snapshot IV for async AEAD requests (Herbert Xu) [RHEL-172204]
  - crypto: algif_aead - Fix minimum RX size check for decryption (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - reject short ahash digests during instance creation (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Fix src offset when decrypting in-place (Herbert Xu) [RHEL-172204]
  - crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: authencesn - reject too-short AAD (assoclen<8) to match ESP/ESN spec (Herbert Xu) [RHEL-172204] {CVE-2026-23060}
  - crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl (Herbert Xu) [RHEL-172204]
  - crypto: af_alg - limit RX SG extraction by receive buffer budget (Herbert Xu) [RHEL-172204] {CVE-2026-31677}
  - crypto: algif_aead - Revert to operating out-of-place (Herbert Xu) [RHEL-172204] {CVE-2026-31431}
  - crypto: af-alg - fix NULL pointer dereference in scatterwalk (Herbert Xu) [RHEL-172204]


author: Patrick Talbert <ptalbert@redhat.com> [5.14.0-687.9.1.el9_8]
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (Sabrina Dubroca) [RHEL-174563] {CVE-2026-43284}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.10.1.el9_8]
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: move skb_gro_receive_list from udp to core (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - net: skbuff: preserve shared-frag marker during coalescing (Sabrina Dubroca) [RHEL-176064] {CVE-2026-46300}
  - ptrace: slightly saner 'get_dumpable()' logic (Ricardo Robaina) [RHEL-176454] {CVE-2026-46333}
  - md/bitmap: fix GPF in write_page caused by resize race (Nigel Croxon) [RHEL-174091] {CVE-2026-43163}
  - RDMA/umem: Fix double dma_buf_unpin in failure path (CKI Backport Bot) [RHEL-174020] {CVE-2026-43128}
  - usbip: validate number_of_packets in usbip_pack_ret_submit() (CKI Backport Bot) [RHEL-171430] {CVE-2026-31607}
  - can: raw: fix ro->uniq use-after-free in raw_rcv() (CKI Backport Bot) [RHEL-170759] {CVE-2026-31532}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.10.1
changelog:
  - Recreate RHEL 5.14.0-687.10.1 from CentOS Stream 9 and upstream stable
    backports (SOURCES/1100-1196)
  - Drop 687.5.3/687.5.4 security-ahead patches now superseded by the RHEL
    backports (xfrm-esp, rxrpc, net-skbuff fragnesia, ptrace, crypto
    authencesn/algif)
  - Keep the smb cifs.spnego ahead-fix (retained as 1197)
  - RHEL changelog for 687.6.1..687.10.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.11.1.el9_8]
changelog:
  - mm/page_alloc: clear page->private in free_pages_prepare() (Rafael Aquini) [RHEL-174750] {CVE-2026-43303}
  - ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw (CKI Backport Bot) [RHEL-175441]
  - smb: client: validate dacloffset before building DACL pointers (Paulo Alcantara) [RHEL-172821]
  - smb: client: use kzalloc to zero-initialize security descriptor buffer (Paulo Alcantara) [RHEL-172821]
  - smb: client: scope end_of_dacl to CIFS_DEBUG2 use in parse_dacl (Paulo Alcantara) [RHEL-172821]
  - smb: client: require a full NFS mode SID before reading mode bits (Paulo Alcantara) [RHEL-172821]
  - smb: client: validate the whole DACL before rewriting it in cifsacl (Paulo Alcantara) [RHEL-172821] {CVE-2026-31709}
  - Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold (David Marlin) [RHEL-165063] {CVE-2026-31408}
  - xfs: fix freemap adjustments when adding xattrs to leaf blocks (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - xfs: delete attr leaf freemap entries when empty (CKI Backport Bot) [RHEL-174058] {CVE-2026-43158}
  - redhat/configs: enable CONFIG_SCLP_OFB for s390x (Jan Polensky) [RHEL-172927]
  - HID: wacom: fix out-of-bounds read in wacom_intuos_bt_irq (CKI Backport Bot) [RHEL-172740] {CVE-2026-43051}
  - netfilter: nf_conntrack_helper: pass helper to expect cleanup (CKI Backport Bot) [RHEL-172620] {CVE-2026-43027}
  - s390/pci: Avoid deadlock between PCI error recovery and mlx5 crdump (Ramesh Chhetri) [RHEL-166859]
  - ice: add dpll peer notification for paired SMA and U.FL pins (Petr Oros) [RHEL-171829]
  - ice: fix missing dpll notifications for SW pins (Petr Oros) [RHEL-171829]
  - dpll: export __dpll_pin_change_ntf() for use under dpll_lock (Petr Oros) [RHEL-171829]
  - ice: fix SMA and U.FL pin state changes affecting paired pin (Petr Oros) [RHEL-162179]
  - ice: fix missing SMA pin initialization in DPLL subsystem (Petr Oros) [RHEL-171832]
  - ice: fix NULL pointer dereference in ice_reset_all_vfs() (Petr Oros) [RHEL-172257]
  - dpll: zl3073x: Remove redundant cleanup in devm_dpll_init() (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: fix REF_PHASE_OFFSET_COMP register width for some chip IDs (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Fix ref frequency setting (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Include current frequency in supported frequencies list (CKI Backport Bot) [RHEL-164442]
  - dpll: zl3073x: Add output pin frequency helper (CKI Backport Bot) [RHEL-164442]
  - scsi: storvsc: Handle PERSISTENT_RESERVE_IN truncation for Hyper-V vFC (Vitaly Kuznetsov) [RHEL-171378]
  - netfilter: ip6t_eui64: reject invalid MAC header for all packets (CKI Backport Bot) [RHEL-171155] {CVE-2026-31685}
  - net: sched: act_csum: validate nested VLAN headers (CKI Backport Bot) [RHEL-171138] {CVE-2026-31684}
  - cifs: make default value of retrans as zero (Paulo Alcantara) [RHEL-170960]
  - ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g (Petr Oros) [RHEL-170701]
  - ice: fix ready bitmap check for non-E822 devices (Petr Oros) [RHEL-170701]
  - ice: perform PHY soft reset for E825C ports at initialization (Petr Oros) [RHEL-170701]
  - ice: fix timestamp interrupt configuration for E825C (Petr Oros) [RHEL-170701]
  - drm/mgag200: fix mgag200_bmc_stop_scanout() (Jocelyn Falempe) [RHEL-150179]
  - nbd: defer config unlock in nbd_genl_connect (Jeff Moyer) [RHEL-166950] {CVE-2025-68366}
  - x86/mm: flush IOMMU before freeing kernel page table pages (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - iommu/sva: add kernel page table IOTLB flush notification (Jerry Snitselaar) [RHEL-167100] {CVE-2025-71089}
  - netfilter: nf_conntrack_h323: check for zero length in DecodeQ931() (CKI Backport Bot) [RHEL-166987] {CVE-2026-23455}
  - crypto: asymmetric_keys - prevent overflow in asymmetric_key_generate_id (CKI Backport Bot) [RHEL-166927] {CVE-2025-68724}
  - ima: don't clear IMA_DIGSIG flag when setting or removing non-IMA xattr (Bruno Meneguele) [RHEL-169734] {CVE-2025-68183}
  - i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" (David Arcari) [RHEL-155312]
  - ice: fix PTP timestamping broken by SyncE code on E825C (Petr Oros) [RHEL-162182]
  - ice: fix missing TX timestamps interrupts on E825 devices (CKI Backport Bot) [RHEL-162185]
  - Revert "mm: pcp: increase pcp->free_count threshold to trigger free_high" (Luiz Capitulino) [RHEL-163464]
  - netfilter: nf_tables: release flowtable after rcu grace period on error (CKI Backport Bot) [RHEL-160461] {CVE-2026-23392}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.12.1.el9_8]
changelog:
  - dm-thin: fix metadata refcount underflow (Benjamin Marzinski) [RHEL-169626]
  - netfilter: xt_tcpmss: check remaining length before reading optlen (CKI Backport Bot) [RHEL-174216] {CVE-2026-43190}
  - wifi: brcmfmac: validate bsscfg indices in IF events (CKI Backport Bot) [RHEL-173848] {CVE-2026-43110}
  - Bluetooth: SCO: fix race conditions in sco_sock_connect() (CKI Backport Bot) [RHEL-172599] {CVE-2026-43023}
  - Bluetooth: MGMT: validate LTK enc_size on load (CKI Backport Bot) [RHEL-172572] {CVE-2026-43020}
  - crypto: tegra - Disable softirqs before finalizing request (CKI Backport Bot) [RHEL-170914]
  - proc: fix type confusion in pde_set_flags() (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: fix missing pde_set_flags() for net proc files (Abhi Das) [RHEL-163343] {CVE-2025-38653}
  - proc: use the same treatment to check proc_lseek as ones for proc_read_iter et.al (CKI Backport Bot) [RHEL-163343] {CVE-2025-38653}
  - pNFS: fix a missing wake up while waiting on NFS_LAYOUT_DRAIN (Olga Kornievskaia) [RHEL-157470]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.12.1
changelog:
  - Recreate RHEL 5.14.0-687.12.1 from CentOS Stream 9 and upstream stable
    backports (SOURCES/1198-1252)
  - RHEL changelog for 687.11.1..687.12.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.13.1.el9_8]
changelog:
  - smb: client: reject userspace cifs.spnego descriptions (Paulo Alcantara) [RHEL-178944] {CVE-2026-46243}
  - s390/dasd: Copy detected format information to secondary device (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Move quiesce state with pprc swap (Ramesh Chhetri) [RHEL-176472]
  - s390/dasd: Fix gendisk parent after copy pair swap (Ramesh Chhetri) [RHEL-176472]
  - nvme: nvme-fc: Ensure ->ioerr_work is cancelled in nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - nvme: nvme-fc: move tagset removal to nvme_fc_delete_ctrl() (Ewan D. Milne) [RHEL-171745]
  - Buffer overflow in drivers/xen/sys-hypervisor.c (Vitaly Kuznetsov) [RHEL-172510] {CVE-2026-31786}
  - crypto: authenc - Correctly pass EINPROGRESS back up to the caller (Vladislav Dronov) [RHEL-172167]
  - crypto: authenc - Fix sleep in atomic context in decrypt_tail (Vladislav Dronov) [RHEL-172167]
  - smb: client: fix OOB reads parsing symlink error response (CKI Backport Bot) [RHEL-171471] {CVE-2026-31613}
  - mm/page_alloc: add vm.thp_thisnode_reclaim sysctl to allow THP reclaim on local node (Nico Pache) [RHEL-164778]
  - mm/page_alloc: simplify __alloc_pages_slowpath() flow (Nico Pache) [RHEL-164778]
  - mm/page_alloc: refactor the initial compaction handling (Nico Pache) [RHEL-164778]
  - mm/page_alloc: ignore the exact initial compaction result (Nico Pache) [RHEL-164778]
  - mm, page_alloc, thp: prevent reclaim for __GFP_THISNODE THP allocations (Nico Pache) [RHEL-164778]
  - mm/page_alloc.c: avoid infinite retries caused by cpuset race (Nico Pache) [RHEL-164778]
  - mm: warn about illegal __GFP_NOFAIL usage in a more appropriate location and manner (Nico Pache) [RHEL-164778]
  - mm: document __GFP_NOFAIL must be blockable (Nico Pache) [RHEL-164778]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.13.1
changelog:
  - Recreate RHEL 5.14.0-687.13.1 from CentOS Stream 9 and upstream stable backports (1253-1269)
  - RHEL changelog for 687.13.1 follows:


author: Tanishi Srivastava <tsrivast@redhat.com> [5.14.0-687.14.1.el9_8]
changelog:
  - RDMA/mlx4: Fix mis-use of RCU in mlx4_srq_event() (Kamal Heib) [RHEL-179988] {CVE-2026-46181}
  - redhat: Remove the mlx5 symbols from kabi (Kamal Heib) [RHEL-181822]
  - ipv6: rpl: reserve mac_len headroom when recompressed SRH grows (Antoine Tenart) [RHEL-178408] {CVE-2026-43501}
  - RDMA/rxe: Fix double free in rxe_srq_from_init (CKI Backport Bot) [RHEL-179712] {CVE-2026-45852}
  - netfilter: ctnetlink: ensure safe access to master conntrack (Florian Westphal) [RHEL-173843] {CVE-2026-43116}
  - ice: fix stats array overflow when VF requests more queues (Michal Schmidt) [RHEL-177526]
  - ice: set max queues in alloc_etherdev_mqs() (Michal Schmidt) [RHEL-174336]
  - ice: use netif_get_num_default_rss_queues() (Michal Schmidt) [RHEL-174336]
  - ice: set default rss queues num to physical cores / 2 (Michal Schmidt) [RHEL-174336]
  - dlm: fix buffer overflow from negative len in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dlm: validate length in dlm_search_rsb_tree (Alexander Aring) [RHEL-173993] {CVE-2026-43125}
  - dpll: zl3073x: add ref-sync pair support (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: add ref sync and output clock type helpers (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: use FIELD_MODIFY() for clear-and-set patterns (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: clean up esync get/set and use zl3073x_out_is_ndiv() (Ivan Vecera) [RHEL-167273]
  - dpll: zl3073x: implement frequency monitoring (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring callback ops (Ivan Vecera) [RHEL-167833]
  - dpll: add frequency monitoring to netlink spec (Ivan Vecera) [RHEL-167833]
  - dpll: zl3073x: drop selected and simplify connected ref getter (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add reference priority to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add DPLL channel status fields to zl3073x_chan (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: introduce zl3073x_chan for DPLL channel state (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add zl3073x_ref_state_update helper (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: use struct_group to partition states (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: add die temperature reporting for supported chips (Ivan Vecera) [RHEL-172938]
  - dpll: zl3073x: detect DPLL channel count from chip ID at runtime (Ivan Vecera) [RHEL-172938]
  - ALSA: 6fire: fix use-after-free on disconnect (CKI Backport Bot) [RHEL-172969] {CVE-2026-31581}
  - net: mana: fix use-after-free in add_adev() error path (CKI Backport Bot) [RHEL-172768] {CVE-2026-43056}
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_conn_usage_count() (CKI Backport Bot) [RHEL-165564] {CVE-2026-23216}
  - net: bonding: fix use-after-free in bond_xmit_broadcast() (CKI Backport Bot) [RHEL-168068] {CVE-2026-31419}
  - x86/kvm: Avoid freeing stack-allocated node in kvm_async_pf_queue_task (Ryosuke Yasuoka) [RHEL-158916]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.15.1.el9_8]
changelog:
  - ip6_tunnel: clear skb2->cb[] in ip4ip6_err() (Guillaume Nault) [RHEL-172646] {CVE-2026-43037}
  - net: openvswitch: Avoid releasing netdev before teardown completes (CKI Backport Bot) [RHEL-170539] {CVE-2026-31508}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.15.1
changelog:
  - Recreate RHEL 5.14.0-687.15.1 from CentOS Stream 9 and upstream stable backports (1270-1284)
  - redhat: Remove the mlx5 symbols from kabi: applied via updated Module.kabi_{aarch64,s390x,x86_64} (RHEL-181822)
  - dpll/zl3073x and ice RSS-queue series consolidated (include RHEL kABI / RHEL-only files)
  - RHEL changelog for 687.14.1..687.15.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.16.1.el9_8]
changelog:
  - s390/mm: Add missing secure storage access fixups for donated memory (Jan Polensky) [RHEL-183317]
  - ibmveth: Disable GSO for packets with small MSS (Mamatha Inamdar) [RHEL-178308]
  - s390/ap: Expose ap_bindings_complete_count counter via sysfs (Jan Polensky) [RHEL-166048]
  - gfs2: Fix use-after-free in iomap inline data write path (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - gfs2: Add metapath_dibh helper (Andrew Price) [RHEL-179589] {CVE-2026-45984}
  - bnxt_en: Fix RSS context delete logic (CKI Backport Bot) [RHEL-180308] {CVE-2026-43260}
  - wifi: mac80211: remove station if connection prep fails (CKI Backport Bot) [RHEL-180121] {CVE-2026-46125}
  - RDMA/mana: Validate rx_hash_key_len (CKI Backport Bot) [RHEL-180085] {CVE-2026-46145}
  - wifi: mac80211: drop stray 'static' from fast-RX rx_result (CKI Backport Bot) [RHEL-180057] {CVE-2026-46152}
  - wifi: mac80211: use safe list iteration in radar detect work (CKI Backport Bot) [RHEL-180025] {CVE-2026-46166}
  - Bluetooth: hci_event: fix potential UAF in SSP passkey handlers (CKI Backport Bot) [RHEL-179359] {CVE-2026-46056}
  - ice: Fix NULL pointer dereference in ice_vsi_set_napi_queues (CKI Backport Bot) [RHEL-175699]
  - mptcp: fix slab-use-after-free in __inet_lookup_established (Davide Caratti) [RHEL-171506] {CVE-2026-31669}
  - dpll: zl3073x: report FFO as DPLL vs input reference offset (Ivan Vecera) [RHEL-175823]
  - dpll: add fractional frequency offset to pin-parent-device (Ivan Vecera) [RHEL-175823]
  - dpll: zl3073x: implement pin operational state reporting (Ivan Vecera) [RHEL-175820]
  - dpll: add pin operational state (Ivan Vecera) [RHEL-175820]
  - can: isotp: fix tx.buf use-after-free in isotp_sendmsg() (CKI Backport Bot) [RHEL-175525] {CVE-2026-31474}
  - Bluetooth: hci_sync: fix stack buffer overflow in hci_le_big_create_sync (CKI Backport Bot) [RHEL-172858] {CVE-2026-31772}
  - xen/privcmd: fix double free via VMA splitting (CKI Backport Bot) [RHEL-172488] {CVE-2026-31787}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.17.1.el9_8]
changelog:
  - net/sched: fix pedit partial COW leading to page cache corruption (Ivan Vecera) [RHEL-177392] {CVE-2026-46331}
  - gitlab-ci: use rhel9.8 builder image (Michael Krausch-Hofmann)
  - rbd: eliminate a race in lock_dwork draining on unmap (CKI Backport Bot) [RHEL-183130]
  - scsi: qla2xxx: Completely fix fcport double free (Ewan D. Milne) [RHEL-179754] {CVE-2026-43414}
  - nvmet-tcp: fix race between ICReq handling and queue teardown (Chris Leech) [RHEL-180102] {CVE-2026-46135}
  - RDMA/mana: Remove user triggerable WARN_ON() in mana_ib_create_qp_rss() (CKI Backport Bot) [RHEL-180158] {CVE-2026-46117}
  - exit: prevent preemption of oopsing TASK_DEAD task (CKI Backport Bot) [RHEL-180016] {CVE-2026-46173}
  - ALSA: usb-audio: Add sanity check for OOB writes at silencing (CKI Backport Bot) [RHEL-173941] {CVE-2026-43279}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.17.1
changelog:
  - Recreate RHEL 5.14.0-687.17.1 from CentOS Stream 9 and upstream stable backports (1285-1311)
  - RHEL changelog for 687.16.1..687.17.1 follows:


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.17.1
changelog:
  - Add fix for CVE-2026-46316 (KVM arm64 vgic-its translation-cache use-after-free) ahead of RHEL (1312)


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.18.1.el9_8]
changelog:
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix HCA caps leak on notifier init failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix crash when moving to switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix peer miss rules host disabled checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: qos: Restrict RTNL area to avoid a lock cycle (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header formulas for higher MTUs and 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix skb size check for 64K pages (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Fix header mapping for 64K pages (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Reduce IMR KSM size when 5-level paging is enabled (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other eswitch support to userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor _get_prio() function (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add other_eswitch support for devx destruction (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Change default device for LAG slaves in RDMA TRANSPORT namespaces (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Skip ESN replay window setup for IPsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix vhca_id access call trace use before alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Fix inverted cap check in tx flow table root disconnect (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return type mismatch in mlx5_esw_vport_vhca_id() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Account for netdev stats in ndo_get_stats64 (Kamal Heib) [RHEL-169057]
  - net/mlx5e: TC, delete flows only for existing peers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix Unbinding uplink-netdev in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in esw_acl_ingress_lgcy_setup() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Restore destroying state bit after profile cleanup (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass netdev to mlx5e_destroy_netdev instead of priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix crash on profile change rollback failure (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Don't print error message due to invalid module (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix NULL pointer dereference in ioctl module EEPROM query (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, multipath, give priority for routes with smaller network prefix (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not update BQL of old txqs during channel reconfiguration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trigger neighbor resolution for unresolved destinations (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use ip6_dst_lookup instead of ipv6_dst_lookup_flow for MAC init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Serialize firmware reset with devlink (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Handle escaped percent properly (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw_tracer, Validate format string parameters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Drain firmware reset in shutdown callback (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, clear reset requested on drain_fw_reset (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix double unregister of HCA_PORTS component (Kamal Heib) [RHEL-169057]
  - net/mlx5: make enable_mpesw idempotent (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support XDP target xmit with dummy program (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Update XDP features in switch channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use standard unit definitions for bandwidth conversion (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use U8_MAX instead of hard coded magic number (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename upper_limit_mbps to upper_limit_100mbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use u64 instead of __u64 in ieee_setmaxrate (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move SF dev table notifier registration outside the PF devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF table notifiers outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the SF HW table notifier outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the vhca event notifier outside of the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Move the esw mode notifier chain outside the devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Initialize events outside devlink lock (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use EOPNOTSUPP instead of ENOTSUPP (Kamal Heib) [RHEL-169057]
  - net/mlx5: Abort new commands if all command slots are stalled (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove redundant bw_share minimal value assignment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recover SQ on excessive PTP TX timestamp delta (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor EEPROM query error handling to return status separately (Kamal Heib) [RHEL-169057]
  - mlx5: extract GRXRINGS from .get_rxnfc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose definition for 1600Gbps link mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, support eswitch inactive mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: MPFS, add support for dynamic enable/disable (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, set non default device per namespace (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, Add other_eswitch support for steering tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add OTHER_ESWITCH HW capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add direct ST mode support for RDMA (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_loc() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Defer channels closure to reduce interface down time (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Pass old channels as argument to mlx5e_switch_priv_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Do not re-apply TIR loopback configuration if not necessary (Kamal Heib) [RHEL-169057]
  - net/mlx5: IPoIB, set self loopback prevention in TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting self loopback prevention bits on TIR init (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use TIR API in mlx5e_modify_tirs_lb() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Enhance function structures for self loopback prevention application (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Convert to new hwtstamp_get/set interface (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename timestamp fields to hwtstamp_config (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Rename hwstamp functions to hwtstamp (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unnecessary tstamp local variable in mlx5i_complete_rx_cqe (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove redundant tstamp pointer from channel structures (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add balance ID support for LAG multiplane groups (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor HCA cap 2 setting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor PTP clock devcom pairing (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add software system image GUID infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use common mlx5_same_hw_devs function (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: Query vports mac address from device (Kamal Heib) [RHEL-169057]
  - RDMA: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix page size bitmap calculation for KSM mode (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback forcing for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Better estimate max_qp_wr to reflect WQE count (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Enable Data-Direct with Relaxed Ordering (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix validation logic in rate limiting (Kamal Heib) [RHEL-169057]
  - net/mlx5: Clean up only new IRQ glue on request_irq() failure (Kamal Heib) [RHEL-169057]
  - mlx5: Fix default values in create CQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potentially misleading debug message (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix wraparound in rate limiting for values above 255 Gbps (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix maxrate wraparound in threshold between units (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Trim the length of the num_doorbell error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing error assignment in mlx5e_xfrm_add_state() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix return value in case of module EEPROM read error (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't zero user_count when destroying FDB tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix IPsec cleanup over MPV device (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to return NULL on failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PPHCR to PCAM supported registers mask (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for striding RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Fix generating skb from non-linear xdp_buff for legacy RQ (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Return 1 instead of 0 in invalid case in mlx5e_mpwrq_umr_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix pre-2.40 binutils assembler error (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent tunnel reformat when tunnel mode not allowed (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent tunnel mode conflicts between FDB and NIC IPsec tables (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use extack in set rxfh callback (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_params for RSS configuration (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Introduce mlx5e_rss_init_params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused mdev param from RSS indir init (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve QoS error messages with actual depth values (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent entering switchdev mode with inconsistent netns (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Generalize complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Improve write-combining test reliability for ARM64 Grace CPUs (Kamal Heib) [RHEL-169057]
  - net/mlx5: fw reset, add reset timeout work (Kamal Heib) [RHEL-169057]
  - net/mlx5: pagealloc: Fix reclaim race during command interface teardown (Kamal Heib) [RHEL-169057]
  - net/mlx5: Stop polling for command response if interface goes down (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC add balance ID and LAG per MP group bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bit for TIR/SQ order capability (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use %pe format specifier for error pointers (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove dead code from total_vfs setter (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow rules for the decrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add flow groups for the packets decrypted by crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Recirculate decrypted packets into TTC table (Kamal Heib) [RHEL-169057]
  - net/mlx5: Change TTC rules to match on undecrypted ESP packets (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add uar access and odp page fault counters (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use unsigned for mlx5e_get_max_num_channels (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use the 'num_doorbells' devlink param (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Use multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using different CQ doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prepare for using multiple TX doorbells (Kamal Heib) [RHEL-169057]
  - net/mlx5: Store the global doorbell in mlx5_priv (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused 'xsk' param of mlx5e_build_xdpsq_param (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove unused 'offset' field from mlx5_sq_bfreg (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix typo of MLX5_EQ_DOORBEL_OFFSET (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Prevent WQE metadata conflicts between timestamping and offloads (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor MACsec WQE metadata shifts (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove VLAN insertion fields from WQE Ether segment (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, add net namespace support (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add net namespace support to devcom (Kamal Heib) [RHEL-169057]
  - net/mlx5: Lag, move devcom registration to LAG layer (Kamal Heib) [RHEL-169057]
  - net/mlx5: Refactor devcom to use match attributes (Kamal Heib) [RHEL-169057]
  - net/mlx5: fix typo in pci_irq.c comment (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add stale counter for PCIe congestion events (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Make PCIe congestion event thresholds configurable (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink total_vfs parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement devlink enable_sriov parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Implement cqe_compress_type via devlink params (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add RS FEC histogram infrastructure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support getcyclesx and getcrosscycles (Kamal Heib) [RHEL-169057]
  - net/mlx5: Extract MTCTR register read logic into helper function (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add PSP capabilities structures and bits (Kamal Heib) [RHEL-169057]
  - net/mlx5: {DR,HWS}, Use the cached vhca_id for this device (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-switch, Set representor attributes for adjacent VFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Register representors for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Create acls root namespace for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Add support for adjacent functions vports discovery (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Move vport acls root namespaces creation to eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: FS, Convert vport acls root namespaces to xarray (Kamal Heib) [RHEL-169057]
  - eth: mlx5: remove Kconfig co-dependency with VXLAN (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set default burst period for TX and RX reporters (Kamal Heib) [RHEL-169057]
  - net/mlx5: Support disabling host PFs (Kamal Heib) [RHEL-169057]
  - net/mlx5: Query to see if host PF is disabled (Kamal Heib) [RHEL-169057]
  - {rdma,net}/mlx5: export mlx5_vport_get_vhca_id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Set/Query hca cap via vhca id (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Cache vport vhca id on first cap query (Kamal Heib) [RHEL-169057]
  - net/mlx5: mlx5_ifc, Add hardware definitions needed for adjacent vports (Kamal Heib) [RHEL-169057]
  - net/mlx5: Don't use %pK through tracepoints (Kamal Heib) [RHEL-169057]
  - IB/mlx5: Fix obj_type mismatch for SRQ event subscriptions (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Refactor optional counters steering code (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH support for reg_user_mr/reg_user_dmabuf_mr (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add DMAH object support (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix incorrect MKEY masking (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix returned type from _mlx5r_umr_zap_mkey() (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: remove redundant check on err on return expression (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Optimize DMABUF mkey page size (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Align mkc page size capability check to PRM (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for devx create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for anchor create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Check CAP_NET_RAW in user namespace for flow create (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add multiple priorities support to RDMA TRANSPORT userspace tables (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Support driver APIs pre_destroy_cq and post_destroy_cq (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix missing FEC RS stats for RS_544_514_INTERLEAVED_QUAD (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, ignore flow level for multi-dest table (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add a miss level for ipsec crypto offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Harden uplink netdev access against device unbind (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Set local Xoff after FW update (Kamal Heib) [RHEL-169057]
  - net/mlx5: Prevent flow steering mode changes in switchdev mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Nack sync reset when SFs are present (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix lockdep assertion on sync reset unload event (Kamal Heib) [RHEL-169057]
  - net/mlx5: Reload auxiliary drivers on fw_activate (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pattern destruction in mlx5hws_pat_get_pattern error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix uninitialized variables in mlx5hws_pat_calc_nop error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_action_get_shared_stc_nic error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix memory leak in hws_pool_buddy_init error path (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve shared buffer capacity during headroom updates (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Query FW for buffer ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Restore missing scheduling node cleanup on vport enable failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix QoS reference leak in vport enable error path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Destroy vport QoS element when no configuration remains (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Preserve tc-bw during parent changes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Remove default QoS group and attach vports directly to root TSAR (Kamal Heib) [RHEL-169057]
  - net/mlx5: Base ECVF devlink port attrs from 0 (Kamal Heib) [RHEL-169057]
  - net/mlx5: CT: Use the correct counter offset (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix table creation UID (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, don't rehash on every kind of insertion failure (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, prevent rehash from filling up the queues (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix complex rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix simple rules rehash error flow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix bad parameter in CQ creation (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_segs when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Expose TIS via devlink tx reporter diagnose (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support routed networks during IPsec MACs initialization (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix potential deadlock by deferring RX timeout recovery (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove skb secpath if xfrm state is not found (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Clear Read-Only port buffer size in PBMC before update (Kamal Heib) [RHEL-169057]
  - net: Fix typos (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix build -Wframe-larger-than warnings (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for device steering tag (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose IFC bits for TPH (Kamal Heib) [RHEL-169057]
  - PCI/TPH: Expose pcie_tph_get_st_table_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove duplicate mkey from SHAMPO header (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Remove mlx5e_shampo_get_log_hd_entry_size() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO, Cleanup reservation size formula (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose cable_length field in PFCC register (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits and enums for buf_ownership (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits to support RSS for IPSec offload (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Properly access RCU protected qdisc_sleeping variable (Kamal Heib) [RHEL-169057]
  - net/mlx5e: fix kdoc warning on eswitch.h (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Enable IPSec hardware offload in legacy mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix an IS_ERR() vs NULL bug in esw_qos_move_node() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add device PCIe congestion ethtool stats (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Create/destroy PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: IFC updates for disabled host PF (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose disciplined_fr_counter through HCA capabilities in mlx5_ifc (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix UMR modifying of mkey page size (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose HCA capability bits for mkey max page size (Kamal Heib) [RHEL-169057]
  - net/mlx5e: RX, Remove unnecessary RQT redirects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Warn when write combining is not supported (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Replace recursive VLAN push handling with an iterative loop (Kamal Heib) [RHEL-169057]
  - net/mlx5e: CT: extract a memcmp from a spinlock section (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Remove unused VLAN insertion logic in TX path (Kamal Heib) [RHEL-169057]
  - eth: mlx5: migrate to the *_rxfh_context ops (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistake "disabliing" -> "disabling" (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add HWS as secondary steering mode (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Shrink empty matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Rearrange to prevent forward declaration (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Track matcher sizes individually (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Decouple matcher RX and TX sizes (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Create STEs directly from matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export rule skip logic (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove incorrect comment (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, remove unused create_dest_array parameter (Kamal Heib) [RHEL-169057]
  - net/mlx5: Manage TC arbiter nodes and implement full support for tc-bw (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add traffic class scheduling support for vport QoS (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add support for setting tc-bw on nodes (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add no-op implementation for setting tc-bw on rate objects (Kamal Heib) [RHEL-169057]
  - net/mlx5: Check device memory pointer before usage (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, fix RDMA TRANSPORT init cleanup flow (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix error handling in RQ memory model registration (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Allocate IB device with net namespace supplied from core dev (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add IFC bits for PCIe Congestion Event object (Kamal Heib) [RHEL-169057]
  - net/mlx5: Small refactor for general object capabilities (Kamal Heib) [RHEL-169057]
  - net/mlx5: fs, add multiple prios to RDMA TRANSPORT steering domain (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Support ethtool tcp-data-split settings (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Implement queue mgmt ops and single channel swap (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Separate pool for headers (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Improve hw gro capability checking (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Remove redundant params (Kamal Heib) [RHEL-169057]
  - net/mlx5e: SHAMPO: Reorganize mlx5_rq_shampo_alloc (Kamal Heib) [RHEL-169057]
  - net/mlx5: Expose serial numbers in devlink info (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix vport loopback for MPV device (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix CC counters query for MPV (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix HW counters query for non-representor devices (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Initialize obj_event->obj_sub_list before xa_insert (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Avoid flexible array warning (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Add support for 200Gbps per lane speeds (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Remove the redundant MLX5_IB_STAGE_UAR stage (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: convert timeouts to secs_to_jiffies() (Kamal Heib) [RHEL-169057]
  - net/mlx5: E-Switch, Fix peer miss rules to use peer eswitch (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix memory leak in cmd_exec() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Correctly set gso_size when LRO is used (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Add new prio for promiscuous mode (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix race between DIM disable and net_dim() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add error checking to hws_bwc_rule_complex_hash_node_get() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Fix leak of Geneve TLV option object (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, make sure the uplink is the last destination (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix missing ip_version handling in definer (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Init mutex on the correct path (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix return value when searching for existing flow group (Kamal Heib) [RHEL-169057]
  - net/mlx5: Ensure fw pages are always allocated on same NUMA (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix an error code in mlx5hws_bwc_rule_create_complex() (Kamal Heib) [RHEL-169057]
  - net/mlx5: Add error handling in mlx5_query_nic_vport_node_guid() (Kamal Heib) [RHEL-169057]
  - net/mlx5e: Allow setting MAC address of representors (Kamal Heib) [RHEL-169057]
  - net/mlx5_core: Add error handling inmlx5_query_nic_vport_qkey_viol_cntr() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, handle modify header actions dependency (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix typo - 'nope' to 'nop' (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, register reformat actions with fw (Kamal Heib) [RHEL-169057]
  - net/mlx5: SWS, fix reformat id error handling (Kamal Heib) [RHEL-169057]
  - net/mlx5: Use to_delayed_work() (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, dump bad completion details (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, rework rehash loop (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix redundant extension of action templates (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, fix counting of rules in the matcher (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, force rehash when rule insertion failed (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, support complex matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, introduce isolated matchers (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose polling function in header file (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, add definer function to get field name str (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, expose function mlx5hws_table_ft_set_next_ft in header (Kamal Heib) [RHEL-169057]
  - net/mlx5: support software TX timestamp (Kamal Heib) [RHEL-169057]
  - RDMA/mlx5: Fix error flow upon firmware failure for RQ destruction (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Disallow matcher IP version mixing (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Harden IP version definer checks (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix IP version decision (Kamal Heib) [RHEL-169057]
  - net/mlx5: Fix spelling mistakes in mlx5_core_dbg message and comments (Kamal Heib) [RHEL-169057]
  - net/mlx5e: ethtool: Fix formatting of ptp_rq0_csum_complete_tail_slow (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Export action STE tables to debugfs (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Free unused action STE tables (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup matcher action STE table (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Use the new action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Implement action STE pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix pool size optimization (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Add fullness tracking to pool (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Cleanup after pool refactoring (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Refactor pool implementation (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Make pool single resource (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Remove unused element array (Kamal Heib) [RHEL-169057]
  - net/mlx5: HWS, Fix matcher action template attach (Kamal Heib) [RHEL-169057]
  - selinux: RHEL-only hotfix for execmem regression (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - selinux: fix overlayfs mmap() and mprotect() access checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add backing_file LSM hooks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for adding LSM blob to backing_file (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - perf/core: Fix MMAP event path names with backing files (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove redundant IOCB_DIO_CALLER_COMP clearing (Ondrej Mosnacek) [RHEL-179444]
  - ovl: remove unneeded non-const conversion (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: constify file ptr in backing_file accessor helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - ovl: Fix nested backing file paths (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: add helper for blob allocations (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_mmap() helper (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_splice_{read,write}() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: factor out backing_file_{read,write}_iter() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: prepare for stackable filesystems backing file helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: store real path instead of fake path in backing file f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: create helper file_user_path() for user displayed mapped file path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: get mnt_writers count for an open backing file's real path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: rename __mnt_{want,drop}_write*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: Fix kernel-doc warnings (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - cachefiles: use kiocb_{start,end}_write() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - lsm: constify the 'file' parameter in security_binder_transfer_file() (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move cleanup from init_file() into its callers (Ondrej Mosnacek) [RHEL-179444]
  - ovl: enable fsnotify events on underlying real files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use backing_file container for internal files with "fake" f_path (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: move kmem_cache_zalloc() into alloc_empty_file*() helpers (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - fs: use a helper for opening kernel internal files (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - locks: fix TOCTOU race when granting write lease (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - binder: use cred instead of task for selinux checks (Ondrej Mosnacek) [RHEL-179444] {CVE-2026-46054}
  - RDMA/iwcm: Fix workqueue list corruption by removing work_list (CKI Backport Bot) [RHEL-179664] {CVE-2026-45898}
  - ALSA: aloop: Fix peer runtime UAF during format-change stop (CKI Backport Bot) [RHEL-179310] {CVE-2026-46090}
  - ipv6: icmp: clear skb2->cb[] in ip6_err_gen_icmpv6_unreach() (Guillaume Nault) [RHEL-172670] {CVE-2026-43038}
  - drm/amd/display: Do not skip unrelated mode changes in DSC validation (CKI Backport Bot) [RHEL-178836] {CVE-2026-31488}
  - netfilter: flowtable: strictly check for maximum number of actions (CKI Backport Bot) [RHEL-176927] {CVE-2026-43329}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.19.1.el9_8]
changelog:
  - RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init() (CKI Backport Bot) [RHEL-179994] {CVE-2026-46176}
  - init/Kconfig: remove CONFIG_GCC_ASM_GOTO_OUTPUT_WORKAROUND (Waiman Long) [RHEL-183183]
  - update workarounds for gcc "asm goto" issue (Waiman Long) [RHEL-183183]
  - init/Kconfig: fix CC_HAS_ASM_GOTO_TIED_OUTPUT test with dash (Waiman Long) [RHEL-183183]
  - work around gcc bugs with 'asm goto' with outputs (Waiman Long) [RHEL-183183]
  - compiler-gcc.h: remove ancient workaround for gcc PR 58670 (Waiman Long) [RHEL-183183]
  - powerpc/64: Force inlining of prevent_user_access() and set_kuap() (Waiman Long) [RHEL-183183]
  - sched/fair: Have SD_SERIALIZE affect newidle balancing (CKI Backport Bot) [RHEL-182776]
  - sched/fair: Skip sched_balance_running cmpxchg when balance is not due (CKI Backport Bot) [RHEL-182776]
  - RDMA/vmw_pvrdma: Fix double free on pvrdma_alloc_ucontext() error path (CKI Backport Bot) [RHEL-179955] {CVE-2026-46189}
  - sctp: discard stale INIT after handshake completion (CKI Backport Bot) [RHEL-178273]
  - netfilter: skip recording stale or retransmitted INIT (CKI Backport Bot) [RHEL-178273]
  - iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler (CKI Backport Bot) [RHEL-172993]
  - iavf: wait for PF confirmation before removing VLAN filters (CKI Backport Bot) [RHEL-172993]
  - iavf: stop removing VLAN filters from PF on interface down (CKI Backport Bot) [RHEL-172993]
  - iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING (CKI Backport Bot) [RHEL-172993]
  - iavf: fix VLAN filter lost on add/delete race (CKI Backport Bot) [RHEL-172993]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.19.1
changelog:
  - Recreate RHEL 5.14.0-687.19.1 from CentOS Stream 9 and upstream stable backports (1313-1695)
  - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312)
  - RHEL changelog for 687.18.1..687.19.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.20.1.el9_8]
changelog:
  - crypto: krb5 - filter out async aead implementations at alloc (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix async decrypt skipping hash verification (CKI Backport Bot) [RHEL-182540]
  - crypto: krb5enc - fix sleepable flag handling in encrypt dispatch (CKI Backport Bot) [RHEL-182540]
  - crypto: testmgr - allow authenc(hmac(sha{256,384}),cts(cbc(aes))) in FIPS mode (CKI Backport Bot) [RHEL-182540]
  - tcp: fix potential race in tcp_v6_syn_recv_sock() (Paolo Abeni) [RHEL-174243] {CVE-2026-43198}
  - crypto: tegra - Return ENOMEM when input buffer allocation fails for ccm (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Fix dma_free_coherent size error (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Don't touch bo refcount in host1x bo pin/unpin (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Add missing CRYPTO_ALG_ASYNC (Vladislav Dronov) [RHEL-182760] {CVE-2026-31739}
  - crypto: tegra - Use int type to store negative error codes (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - Remove the use of dev_err_probe() (Vladislav Dronov) [RHEL-182760]
  - crypto: tegra - use API helpers to setup fallback request (Vladislav Dronov) [RHEL-182760]
  - scsi: qla2xxx: Add support to report MPI FW state (Ewan D. Milne) [RHEL-181886]
  - net: atm: fix crash due to unvalidated vcc pointer in sigd_send() (CKI Backport Bot) [RHEL-167051] {CVE-2026-31411}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.20.1
changelog:
  - Recreate RHEL 5.14.0-687.20.1 from CentOS Stream 9 and upstream stable backports (1696-1709)
  - Retain AlmaLinux ahead-of-RHEL fix for CVE-2026-46316 (1312)
  - RHEL changelog for 687.19.1..687.20.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.21.1.el9_8]
changelog:
  - fs/smb/client: fix out-of-bounds read in cifs_sanitize_prepath (CKI Backport Bot) [RHEL-189503] {CVE-2026-43112}
  - Enable workaround for ARM64 ERRATUM 4118414 (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add NVIDIA Olympus definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on Microsoft Azure Cobalt 100 CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on NVIDIA Olympus CPU (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Mitigate TLBI errata on various Arm CPUs (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: errata: Apply workarounds for Neoverse-V3AE (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add Neoverse-V3AE definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Ultra definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Premium definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - arm64: cputype: Add C1-Pro definitions (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - Clean up documentation mess left by previous backport (Mark Salter) [RHEL-183625] {CVE-2025-10263}
  - KVM: arm64: vgic-its: Drop the translation cache reference only for the erased entry (CKI Backport Bot) [RHEL-183969] {CVE-2026-46316}
  - netfilter: nft_inner: Fix IPv6 inner_thoff desync (CKI Backport Bot) [RHEL-181929] {CVE-2026-46244}
  - procfs: fix missing RCU protection when reading real_parent in do_task_stat() (CKI Backport Bot) [RHEL-181907] {CVE-2026-46259}
  - drm/gem: Fix inconsistent plane dimension calculation in drm_gem_fb_init_with_funcs() (CKI Backport Bot) [RHEL-179909] {CVE-2026-46209}
  - sctp: revalidate list cursor after sctp_sendmsg_to_asoc() in SCTP_SENDALL (CKI Backport Bot) [RHEL-179865] {CVE-2026-46227}
  - nouveau/gsp: drop WARN_ON in ACPI probes (Lyude Paul) [RHEL-160966]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.22.1.el9_8]
changelog:
  - smb/client: fix out-of-bounds read in smb2_compound_op() (Paulo Alcantara) [RHEL-180041] {CVE-2026-46155}
  - smb: client: fix off-by-8 bounds check in check_wsl_eas() (Paulo Alcantara) [RHEL-180041]
  - xfrm: defensively unhash xfrm_state lists in __xfrm_state_delete (Sabrina Dubroca) [RHEL-180176] {CVE-2026-46116}
  - net: gro: don't merge zcopy skbs (Sabrina Dubroca) [RHEL-177878] {CVE-2026-46323}
  - net/mana: Null service_wq on setup error to prevent double destroy (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}
  - net: mana: Fix double destroy_workqueue on service rescan PCI path (CKI Backport Bot) [RHEL-180271] {CVE-2026-43276}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.22.1
changelog:
  - Recreate RHEL 5.14.0-687.22.1 from CentOS Stream 9 and upstream stable backports (1713-1735)
  - Retain AlmaLinux ahead-of-RHEL fixes: KVM x86 shadow paging (1710-1711), eventpoll
    ep_remove use-after-free CVE-2026-46242 (1712)
  - RHEL 5.14.0-687.21.1 now also carries the vgic-its fix (CVE-2026-46316); the AlmaLinux
    ahead-patch (1312) is retained and RHEL's duplicate copy omitted
  - CONFIG_ARM64_ERRATUM_4118414 enabled for aarch64 (CVE-2025-10263)
  - RHEL changelog for 687.21.1..687.22.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.23.1.el9_8]
changelog:
  - eventpoll: refresh epi_fget() / ep_remove_file() comments (Ian Kent) [RHEL-180773]
  - eventpoll: Fix integer overflow in ep_loop_check_proc() (Ian Kent) [RHEL-180773]
  - eventpoll: drop vestigial epi->dying flag (Ian Kent) [RHEL-180773]
  - eventpoll: drop dead bool return from ep_remove_epi() (Ian Kent) [RHEL-180773]
  - eventpoll: refresh eventpoll_release() fast-path comment (Ian Kent) [RHEL-180773]
  - eventpoll: move f_lock acquisition into ep_remove_file() (Ian Kent) [RHEL-180773]
  - eventpoll: fix ep_remove struct eventpoll / struct file UAF (Ian Kent) [RHEL-180773] {CVE-2026-46242}
  - eventpoll: drop vestigial __ prefix from ep_remove_{file,epi}() (Ian Kent) [RHEL-180773]
  - eventpoll: move epi_fget() up (Ian Kent) [RHEL-180773]
  - eventpoll: rename ep_remove_safe() back to ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: kill __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: split __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: use hlist_is_singular_node() in __ep_remove() (Ian Kent) [RHEL-180773]
  - eventpoll: defer struct eventpoll free to RCU grace period (Ian Kent) [RHEL-173830] {CVE-2026-43074}
  - epoll: annotate racy check (Ian Kent) [RHEL-180773]
  - netfilter: bridge: make ebt_snat ARP rewrite writable (CKI Backport Bot) [RHEL-182344]
  - tg3: Fix race for querying speed/duplex (CKI Backport Bot) [RHEL-182768]


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.23.1
changelog:
  - Recreate RHEL 5.14.0-687.23.1 from CentOS Stream and upstream stable backports (1739-1755)
  - The AlmaLinux ahead-of-RHEL eventpoll CVE-2026-46242 fix (1712) is superseded by
    RHEL's eventpoll series carrying the same fix and is dropped
  - Temporarily drop the rtmutex remove_waiter() fixes (1736, 1738)
  - RHEL changelog for 687.23.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.24.1.el9_8]
changelog:
  - KVM: x86: Fix shadow paging use-after-free due to unexpected role (Paolo Bonzini) [RHEL-192400] {CVE-2026-53359}
  - KVM: x86: Fix shadow paging use-after-free due to unexpected GFN (CKI Backport Bot) [RHEL-186702] {CVE-2026-46113}
  - net/sched: ets: Always remove class from active list before deleting in ets_qdisc_change (CKI Backport Bot) [RHEL-183004] {CVE-2025-71066}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.24.1
changelog:
  - Recreate RHEL 5.14.0-687.24.1 from upstream stable backports (1758-1760)
  - The AlmaLinux ahead-of-RHEL KVM x86 shadow paging fixes (1710, 1711) are
    superseded by RHEL's copies and dropped
  - RHEL changelog for 687.24.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.25.1.el9_8]
changelog:
  - futex/requeue: Revert "Prevent NULL pointer dereference in remove_waiter() on self-deadlock"" (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - locking/rtmutex: Skip remove_waiter() when waiter is not enqueued (Phil Auld) [RHEL-193245] {CVE-2026-53166}
  - futex/requeue: Prevent NULL pointer dereference in remove_waiter() on self-deadlock (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - rtmutex: Use waiter::task instead of current in remove_waiter() (Phil Auld) [RHEL-193151] {CVE-2026-43499}
  - net: bridge: use a stable FDB dst snapshot in RCU readers (Mohammad Heib) [RHEL-179330] {CVE-2026-46086}
  - kallsyms/bpf: rename __bpf_address_lookup() to bpf_address_lookup() (Anubhav Shelat) [RHEL-183236]
  - kallsyms: clean up modname and modbuildid initialization in kallsyms_lookup_buildid() (Anubhav Shelat) [RHEL-183236]
  - net: fix memory leak in skb_segment_list for GRO packets (CKI Backport Bot) [RHEL-189959] {CVE-2026-22979}
  - crypto: ccp - copy IV using skcipher ivsize (CKI Backport Bot) [RHEL-188459] {CVE-2026-53016}


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.25.1
changelog:
  - Recreate RHEL 5.14.0-687.25.1 from CentOS Stream 9 and upstream stable backports (1761-1769)
  - The AlmaLinux ahead-of-RHEL rtmutex remove_waiter() fixes for CVE-2026-43499
    (1756, 1757) are superseded by RHEL's copies and dropped
  - RHEL changelog for 687.25.1 follows:


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.26.1
changelog:
  - Recreate RHEL 5.14.0-687.26.1 from CentOS Stream 9 backports (1770)
  - RHEL changelog for 687.26.1 follows:


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.27.1.el9_8]
changelog:
  - drm/gem: Try to fix change_handle ioctl, attempt 4 (Jocelyn Falempe) [RHEL-179886]
  - drm/gem: fix race between change_handle and handle_delete (Jocelyn Falempe) [RHEL-179886]
  - drm: Replace old pointer to new idr (Jocelyn Falempe) [RHEL-179886]
  - drm: Set old handle to NULL before prime swap in change_handle (Jocelyn Falempe) [RHEL-179886] {CVE-2026-46215}
  - drm: Do not allow userspace to trigger kernel warnings in drm_gem_change_handle_ioctl() (Jocelyn Falempe) [RHEL-179886]
  - crypto: af_alg - zero initialize memory allocated via sock_kmalloc (Herbert Xu) [RHEL-189943] {CVE-2025-71113}
  - crypto: af_alg - Disallow multiple in-flight AIO requests (Herbert Xu) [RHEL-189943]
  - scsi: core: Wake up the error handler when final completions race against each other (CKI Backport Bot) [RHEL-189975] {CVE-2026-23110}
  - net/mlx5: HWS: Reject unsupported remove-header action (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix eswitch mode block underflow on IPsec acquire SA (Kamal Heib) [RHEL-188121]
  - net/mlx5: Do not restore destination-less TC rules (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Don't leak RSS context in case of error (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix race condition in secondary device probe/remove (Kamal Heib) [RHEL-188121]
  - net/mlx5e: SD, Fix missing cleanup on probe error (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD, Keep multi-pf debugfs entries on primary (Kamal Heib) [RHEL-188121]
  - net/mlx5: SD: Serialize init/cleanup (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Add missing store/release for lock elision pattern (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix null-ptr-deref in Raw Packet QP creation (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in DCT destroy due to race with create (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UAF in SRQ destroy due to race with create (Kamal Heib) [RHEL-188121]
  - net/mlx5e: IPsec, fix ASO poll timeout with read_poll_timeout_atomic() (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix features not applied during netdev registration (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix switchdev mode rollback in case of failure (Kamal Heib) [RHEL-188121]
  - net/mlx5: Avoid "No data available" when FW version queries fail (Kamal Heib) [RHEL-188121]
  - net/mlx5: lag: Check for LAG device before creating debugfs (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix race condition during IPSec ESN update (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Prevent concurrent access to IPSec ASO context (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix deadlock between devlink lock and esw->wq (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix "scheduling while atomic" in IPsec MAC address query (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix missing devlink lock in SRIOV enable error path (Kamal Heib) [RHEL-188121]
  - net/mlx5: E-switch, Clear legacy flag when moving to switchdev (Kamal Heib) [RHEL-188121]
  - net/mlx5: LAG, disable MPESW in lag_disable_change() (Kamal Heib) [RHEL-188121]
  - net/mlx5: DR, Fix circular locking dependency in dump (Kamal Heib) [RHEL-188121]
  - net/mlx5e: MACsec, add ASO poll loop in macsec_aso_set_arm_event (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix misidentification of write combining CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5e: Fix misidentification of ASO CQE during poll loop (Kamal Heib) [RHEL-188121]
  - net/mlx5: Fix multiport device check over light SFs (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix memory leak in GET_DATA_DIRECT_SYSFS_PATH handler (Kamal Heib) [RHEL-188121]
  - IB/mlx5: Fix port speed query for representors (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix UMR hang in LAG error state unload (Kamal Heib) [RHEL-188121]
  - RDMA/mlx5: Fix ucaps init error flow (Kamal Heib) [RHEL-188121]
  - Bluetooth: l2cap: Add missing chan lock in l2cap_ecred_reconf_rsp (CKI Backport Bot) [RHEL-188333] {CVE-2026-53071}
  - libperf build: Always place libperf includes first (Michael Petlan) [RHEL-183980]
  - libperf: Don't remove -g when EXTRA_CFLAGS are used (Michael Petlan) [RHEL-183980]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.28.1.el9_8]
changelog:
  - fanotify: fix false positive on permission events (CKI Backport Bot) [RHEL-180073] {CVE-2026-46150}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.29.1.el9_8]
changelog:
  - can: bcm: defer rx_op deallocation to workqueue to fix thrtimer UAF (Jamie Bainbridge) [RHEL-212685]
  - dpll: fix NULL pointer dereference in dpll_msg_add_pin_ref_sync() (CKI Backport Bot) [RHEL-212061]
  - net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels (Antoine Tenart) [RHEL-179297] {CVE-2026-46099}
  - xfrm: esp: restore combined single-frag length gate (CKI Backport Bot) [RHEL-178337]


author: Eduard Abdullin <eabdullin@almalinux.org> - 5.14.0-687.29.1
changelog:
  - Use AlmaLinux OS secure boot cert
  - Debrand for AlmaLinux OS
  - Add KVM support for ppc64le
  - KVM: PPC: Book3S HV: Make PMU save/restore symbols global for module builds


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.29.1
changelog:
  - proc: fix a dentry lock race between release_task and lookup
  - hpsa: bring back deprecated PCI ids #CFHack #CFHack2024
  - mptsas: bring back deprecated PCI ids #CFHack #CFHack2024
  - megaraid_sas: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla2xxx: bring back deprecated PCI ids #CFHack #CFHack2024
  - qla4xxx: bring back deprecated PCI ids
  - lpfc: bring back deprecated PCI ids
  - be2iscsi: bring back deprecated PCI ids
  - kernel/rh_messages.h: enable all disabled pci devices by moving to
    unmaintained


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-686.el9]
changelog:
  - pmdomain: core: Move the unused cleanup to a _sync initcall (Rupinderjit Singh) [RHEL-147489]
  - net/ipv4: Use nested-BH locking for ipv4_tcp_sk. (Davide Caratti) [RHEL-82508]
  - ipv4/tcp: do not use per netns ctl sockets (Davide Caratti) [RHEL-82508]
  - cpuidle: menu: Use residency threshold in polling state override decisions (Mark Langsdorf) [RHEL-135548]
  - spi: tegra210-qspi: Remove cache operations (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Check hardware status on timeout (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Refactor error handling into helper functions (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Fix timeout handling (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Add support for internal DMA (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: Update dummy sequence configuration (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: add rate limiting and simplify timeout error message (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: use WARN_ON_ONCE instead of WARN_ON for timeouts (Charles Mirabile) [RHEL-127129]
  - spi: tegra210-quad: modify chip select (CS) deactivation (Charles Mirabile) [RHEL-127129]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.el9]
changelog:
  - cifs: some missing initializations on replay (Paulo Alcantara) [RHEL-148619]
  - cifs: remove unnecessary tracing after put tcon (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix data corruption due to racy lease checks (Paulo Alcantara) [RHEL-148619]
  - smb: client: fix regression with mount options parsing (Paulo Alcantara) [RHEL-148619]
  - Revert: ipmi:msghandler: Move timer handling into a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move SI type information into an info structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use READ_ONCE on run_to_completion (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Rename recv_work to smi_work (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Deliver user messages in a work queue (Tony Camuso) [RHEL-149762]
  - Revert: ipmi_msghandler: Change the events lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Use the system_wq, not system_bh_wq (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu from the ipmi user structure (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove srcu for the ipmi_interfaces list (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Change lock to mutex (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a note about the pretimeout callback (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove some user level processing in panic mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix locking around users and interfaces (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't acquire a user refcount for queued messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't check for shutdown when returning responses (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Remove proc_fs.h (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Shut down lower layer first at unregister (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Add a error return from unhandle LAN cmds (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Rework startup of IPMI devices (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Don't deliver messages to deleted users (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:ssif: Fix a shutdown race (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Export and fix panic messaging capability (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:watchdog: Use the new interface for panic messages (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler: Fix potential memory corruption in ipmi_create_user() (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix strcpy source and destination the same (Tony Camuso) [RHEL-149762]
  - Revert: char: ipmi: remove redundant variable 'type' and check (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Use dev_warn_ratelimited() for incorrect message warnings (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:msghandler:Change seq_lock to a mutex (Tony Camuso) [RHEL-149762]
  - Revert: Revert "ipmi: fix msg stack when IPMI is disconnected" (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rework user message limit handling (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Differentiate between reset and firmware update in maintenance (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Disable sysfs access and requests in maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add a maintenance mode sysfs file (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Set a timer for maintenance mode (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Merge some if statements (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Move flags get start to its own function (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Allow an SMI sender to return an error (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Rename "user_data" to "recv_msg" in an SMI message (Tony Camuso) [RHEL-149762]
  - Revert: ipmi:si: Gracefully handle if the BMC is non-functional (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Add Loongson-2K BMC support (Tony Camuso) [RHEL-149762]
  - Revert: ipmi: Fix handling of messages with provided receive message pointer (Tony Camuso) [RHEL-149762]
  - nvme: fix memory leak in quirks_param_set() (Maurizio Lombardi) [RHEL-148489]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.1.1.el9_8]
changelog:
  - mm/hugetlb: fix excessive IPI broadcasts when unsharing PMD tables using mmu_gather (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: add missing hugetlb_lock in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: convert use of struct page to folio in __unmap_hugepage_range() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor __unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: refactor unmap_hugepage_range() to take folio instead of page (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: pass folio instead of page to unmap_ref_private() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/hugetlb: fix hugetlb_pmd_shared() (Rafael Aquini) [RHEL-150765] {CVE-2026-23100}
  - mm/hugetlb: fix copy_hugetlb_page_range() to use ->pt_share_count (Rafael Aquini) [RHEL-150765]
  - mm: hugetlb: independent PMD page table shared count (Rafael Aquini) [RHEL-150765] {CVE-2024-57883}
  - mm/rmap: fix two comments related to huge_pmd_unshare() (Rafael Aquini) [RHEL-150765]
  - mm/rmap: introduce and use hugetlb_remove_rmap() (Rafael Aquini) [RHEL-150765]
  - x86/mm/64: define ARCH_PAGE_TABLE_SYNC_MASK and arch_sync_kernel_mappings() (Rafael Aquini) [RHEL-150765] {CVE-2025-39845}
  - mm: introduce and use {pgd,p4d}_populate_kernel() (Rafael Aquini) [RHEL-150765]
  - mm: move page table sync declarations to linux/pgtable.h (Rafael Aquini) [RHEL-150765] {CVE-2025-39844}
  - redhat: update self-test data (Patrick Talbert)
  - redhat: set defaults for 9.8 (Patrick Talbert)
  - gitlab-ci: disttag override for 9.8 (Patrick Talbert)
  - ipv6: BUG() in pskb_expand_head() as part of calipso_skbuff_setattr() (CKI Backport Bot) [RHEL-143546] {CVE-2025-71085}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.2.1.el9_8]
changelog:
  - netfilter: nf_tables: fix inverted genmask check in nft_map_catchall_activate() (CKI Backport Bot) [RHEL-149749] {CVE-2026-23111}
  - bonding: fix use-after-free due to enslave fail after slave array update (CKI Backport Bot) [RHEL-152386] {CVE-2026-23171}
  - Add signing key for Nvidia Jetson and Bluefield GPU signing keys (Enrique Belarte Luque) [RHEL-145938]
  - Add NVIDIA Jetson signing key for OOT modules (Enrique Belarte Luque) [RHEL-145938]
  - vsock: lock down child_ns_mode as write-once (Stefano Garzarella) [RHEL-117126]
  - vsock: Use container_of() to get net namespace in sysctl handlers (Stefano Garzarella) [RHEL-117126]
  - vsock: prevent child netns mode switch from local to global (Stefano Garzarella) [RHEL-117126]
  - vsock: fix child netns mode initialization (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns support to virtio transports (Stefano Garzarella) [RHEL-117126]
  - virtio: set skb owner of virtio_transport_reset_no_sock() reply (Stefano Garzarella) [RHEL-117126]
  - vsock: add netns to vsock core (Stefano Garzarella) [RHEL-117126]
  - vhost/vsock: improve RCU read sections around vhost_vsock_get() (Stefano Garzarella) [RHEL-117126]
  - vsock: fix lock inversion in vsock_assign_transport() (Stefano Garzarella) [RHEL-117126]
  - vsock: Do not allow binding to VMADDR_PORT_ANY (Stefano Garzarella) [RHEL-117126]
  - vsock: reset socket state when de-assigning the transport (Stefano Garzarella) [RHEL-117126]
  - vsock/virtio: cancel close work in the destructor (Stefano Garzarella) [RHEL-117126]
  - dpll: zl3073x: Fix output pin phase adjustment sign (Ivan Vecera) [RHEL-149693]


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.3.1.el9_8]
changelog:
  - HID: intel-thc-hid: intel-thc: Fix incorrect pointer arithmetic in I2C regs save (Benjamin Tissoires) [RHEL-142234] {CVE-2025-39818}
  - NFSv4: Check for delegation validity in nfs_start_delegation_return_locked() (Scott Mayhew) [RHEL-151415]
  - perf/amd/ibs: Avoid calling perf_allow_kernel() from the IBS NMI handler (Michael Petlan) [RHEL-155340]
  - perf: Extend the bit width of the arch-specific flag (Michael Petlan) [RHEL-155340]
  - perf: Remove unnecessary parameter of security check (Michael Petlan) [RHEL-155340]
  - scsi: target: iscsi: Fix use-after-free in iscsit_dec_session_usage_count() (CKI Backport Bot) [RHEL-150423] {CVE-2026-23193}
  - nfsd: add list_head nf_gc to struct nfsd_file (Roberto Bergantinos Corpas) [RHEL-152552]
  - redhat: genlog: add new JIRA cloud server hostname (Jan Stancek)
  - gfs2: less aggressive low-memory log flushing (Andreas Gruenbacher) [RHEL-153055]
  - io_uring: graduate to full support (Jeff Moyer) [RHEL-120699]
  - netfilter: nf_tables: fix use-after-free in nf_tables_addchain() (CKI Backport Bot) [RHEL-153270] {CVE-2026-23231}
  - net: atm: fix /proc/net/atm/lec handling (Hangbin Liu) [RHEL-146424] {CVE-2025-38180}
  - net: atm: add lec_mutex (Hangbin Liu) [RHEL-146424]
  - macvlan: observe an RCU grace period in macvlan_common_newlink() error path (Hangbin Liu) [RHEL-150227]
  - macvlan: fix error recovery in macvlan_common_newlink() (Hangbin Liu) [RHEL-150227] {CVE-2026-23209}
  - spi: tegra210-quad: Protect curr_xfer check in IRQ handler (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer clearing in tegra_qspi_non_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer in tegra_qspi_combined_seq_xfer (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Protect curr_xfer assignment in tegra_qspi_setup_transfer_one (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Move curr_xfer read inside spinlock (Charles Mirabile) [RHEL-145814]
  - spi: tegra210-quad: Return IRQ_HANDLED when timeout already processed transfer (Charles Mirabile) [RHEL-145814]
  - migrate: correct lock ordering for hugetlb file folios (Luiz Capitulino) [RHEL-147267] {CVE-2026-23097}
  - ALSA: aloop: Fix racy access at PCM trigger (Jaroslav Kysela) [RHEL-150131] {CVE-2026-23191}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.4.1.el9_8]
changelog:
  - mm/damon/sysfs: cleanup attrs subdirs on context dir setup failure (Audra Mitchell) [RHEL-150478] {CVE-2026-23144}
  - ixgbevf: add missing negotiate_features op to Hyper-V ops table (CKI Backport Bot) [RHEL-155365]
  - libceph: adapt ceph_x_challenge_blob hashing and msgr1 message signing (Ilya Dryomov) [RHEL-155611]
  - libceph: add support for CEPH_CRYPTO_AES256KRB5 (Ilya Dryomov) [RHEL-155611]
  - libceph: introduce ceph_crypto_key_prepare() (Ilya Dryomov) [RHEL-155611]
  - libceph: generalize ceph_x_encrypt_offset() and ceph_x_encrypt_buflen() (Ilya Dryomov) [RHEL-155611]
  - libceph: define and enforce CEPH_MAX_KEY_LEN (Ilya Dryomov) [RHEL-155611]
  - libceph: Remove unused ceph_crypto_key_encode (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: disable CONFIG_CRYPTO_KRB5_SELFTESTS (Ilya Dryomov) [RHEL-155611]
  - redhat/configs: enable CONFIG_CRYPTO_KRB5[ENC] (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Fix memory leak in krb5_test_one_prf() (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Fix change to use SG miter to use offset (Ilya Dryomov) [RHEL-155611]
  - crypto: krb5 - Use SG miter instead of doing it by hand (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement crypto self-testing (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Camellia enctypes from rfc6803 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc8009 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the AES enctypes from rfc3962 (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 get_mic and verify_mic (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 encrypt and decrypt functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide RFC3961 setkey packaging functions (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement the Kerberos5 rfc3961 key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Provide infrastructure and key derivation (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to perform requests (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to alloc and prepare a crypto object (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add an API to query the layout of the crypto section (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Implement Kerberos crypto core (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Add some constants out of sunrpc headers (Ilya Dryomov) [RHEL-155611]
  - crypto/krb5: Test manager data (Ilya Dryomov) [RHEL-155611]
  - crypto: Add 'krb5enc' hash and cipher AEAD algorithm (Ilya Dryomov) [RHEL-155611]
  - ice: Fix PTP NULL pointer dereference during VSI rebuild (CKI Backport Bot) [RHEL-150246] {CVE-2026-23210}
  - smb: client: fix oops due to uninitialised var in smb2_unlink() (Paulo Alcantara) [RHEL-154396]
  - wifi: mac80211_hwsim: fix typo in frequency notification (CKI Backport Bot) [RHEL-148653] {CVE-2026-23040}


author: CKI KWF Bot <cki-ci-bot+kwf-gitlab-com@redhat.com> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - RDMA/umad: Reject negative data_len in ib_umad_write (CKI Backport Bot) [RHEL-156878] {CVE-2026-23243}
  - net/mlx5: Fix ECVF vports unload on shutdown flow (CKI Backport Bot) [RHEL-154538] {CVE-2025-38109}
  - iavf: fix PTP use-after-free during reset (Petr Oros) [RHEL-112567]


author: Andrew Lukoshko <alukoshko@almalinux.org> [5.14.0-687.5.1.el9_8]
changelog:
  - kabi: enable check-kabi (Čestmír Kalina) [RHEL-153672]
  - Set version to 5.14.0-687.5.1.el9_8 (Andrew Lukoshko)
  - kabi: add symbols to stablelist (Čestmír Kalina) [RHEL-153672]
  - Merge tag 'kernel-5.14.0-687.5.1.el9_8' into main (Patrick Talbert)
  - Merge tag 'kernel-5.14.0-687.3.1.el9_8' into main (Patrick Talbert)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.5.3
changelog:
  - xfrm: esp: avoid in-place decrypt on shared skb frags (CVE-2026-43284)
  - rxrpc: linearize incoming DATA packet when it has paged frags (CVE-2026-43500)
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (CVE-2026-46300 "Fragnesia")
  - ptrace: require CAP_SYS_PTRACE on mm-less tasks (CVE-2026-46333, kABI-safe
    replacement for upstream 31e62c2ebbfd, Qualys Security Advisory)
  - crypto: full set of authencesn/algif AEAD Copy-Fail fixes (CVE-2026-31431)


author: Andrew Lukoshko <alukoshko@almalinux.org> - 5.14.0-687.5.4
changelog:
  - net: skbuff: propagate shared-frag marker through frag-transfer helpers
    (refresh to upstream v5: now also covers skb_segment(); CVE-2026-46300
    "Fragnesia")
  - smb: client: reject userspace cifs.spnego descriptions (upstream commit
    3da1fdf4efbc)


author: Julien Rische <jrische@redhat.com> - 1.21.1-3
changelog:
  - CVE-2024-37370 CVE-2024-37371
    Fix vulnerabilities in GSS message token handling
    Resolves: RHEL-45402 RHEL-45392


author: Julien Rische <jrische@redhat.com> - 1.21.1-4
changelog:
  - libkrad: implement support for Message-Authenticator (CVE-2024-3596)
    Resolves: RHEL-55423
  - Fix various issues detected by static analysis
    Resolves: RHEL-58216
  - Remove RSA protocol for PKINIT
    Resolves: RHEL-15323


author: Julien Rische <jrische@redhat.com> - 1.21.1-5
changelog:
  - Support PKCS11 EC client certs in PKINIT
    Resolves: RHEL-74374
  - kdb5_util: fix DB entry flags on modification
    Resolves: RHEL-56059
  - Add ECDH support for PKINIT (RFC5349)
    Resolves: RHEL-4902


author: Julien Rische <jrische@redhat.com> - 1.21.1-8
changelog:
  - Do not block HMAC-MD4/5 in FIPS mode
    Resolves: RHEL-88704
  - Don't issue RC4 session keys by default (CVE-2025-3576)
    Resolves: RHEL-88048
  - Add PKINIT paChecksum2 from MS-PKCA v20230920
    Resolves: RHEL-82647


author: Julien Rische <jrische@redhat.com> - 1.21.1-9
changelog:
  - krad: packet ID fetched from uninitialized variable
    Resolves: RHEL-145355
  - Create sub-package for xrealmauthz KDC plugin
    Resolves: RHEL-67468
  - Improving kerberos ulog resize efficiency
    Resolves: RHEL-145359


author: Julien Rische <jrische@redhat.com> - 1.21.1-10
changelog:
  - Fix NegoEx parsing vulnerabilities (CVE-2026-40355, CVE-2026-40356)
    Resolves: RHEL-171590 RHEL-171596


author: Christine Caulfield <ccaulfie@redhat.com> - 1.24-2
changelog:
  - Fix libnozzle tests failing & covscan warning on api_knet_handle_new test
    Resolves: rhbz#2024090


author: Christine Caulfield <ccaulfie@redhat.com> - 1.28-1
changelog:
  Rebase to 1.28 for startup and performance fixes
     threads: add config check to match min value with pong timeouts
     rx: allow links to be active faster
     links: fix ping interval and pong timeout value checking
     crypto: Try crypt and decrypt on crypto_init
     tx: Remove expensive memsets
     log: Add a TRACE log level
    Resolves: #RHEL-11787


author: Richard Hughes <richard@hughsie.com> 0.7.18-5
changelog:
  - Backport a patch from upstream to fix handling unknown tags in AppStream metadata
  - Resolves: #RHEL-34564


author: Filip Januš <fjanus@redhat.com> - 5.3.28-54
changelog:
  - Add db_converter into -utils subpackage
  - It allowes to convert BerkeleyDB database format to GDBM/LMDB format
  - Resolves: RHEL-35607


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-36
changelog:
  - Add 0128-multipath-tools-move-DEFAULT_SOCKET-definition-into-.patch
  - Add 0129-multipath-tools-add-helper-mpath_fill_sockaddr__.patch
  - Add 0130-libmpathutil-add-support-for-Unix-pathname-sockets.patch
  - Add 0131-libmpathutil-move-systemd_listen_fds-support-into-mu.patch
  - Add 0132-multipathd-move-uxsock_trigger-to-uxlsnr.c.patch
  - Add 0133-multipathd-uxlsnr-use-symbolic-values-for-pollfd-ind.patch
  - Add 0134-multipathd-make-uxsock_listen-take-a-pointer-to-fd.patch
  - Add 0135-multipathd-allow-receiving-two-socket-fds-from-syste.patch
  - Add 0136-multipathd-listen-on-pathname-and-abstract-socket-by.patch
  - Add 0137-libmpathcmd-try-both-abstract-and-pathname-sockets.patch
  - Add 0138-libmpathcmd-honor-MULTIPATH_SOCKET_NAME-environment-.patch
  - Add 0139-multipathd-honor-MULTIPATH_SOCKET_NAME-environment-v.patch
    * Fixes RHEL-78758 ("RFE: Enable multipathd to communicate with a
      process in another network namespace")
  - Resolves: RHEL-78758


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-37
changelog:
  - Add 0140-multipath-clean-up-find_multipaths-value-names.patch
  - Add 0141-multipathd-Add-multipathd-man-page-section-about-soc.patch
    * Fixes RHEL-82307 ("There is no man page for RFE: Enable multipathd
      to communicate with a process in another network namespace")
  - Fix multipath_conf_syntax OSCI test.
  - Resolves: RHEL-82307


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-38
changelog:
  - Add 0142-multipathd-monitor-new-multipath-dev-even-if-we-can-.patch
  - Add 0143-libmultipath-add-helper-function-check_path_wwid_cha.patch
  - Add 0144-multipathd-re-add-paths-skipped-because-they-were-of.patch
    * Fixes RHEL-82534 ("multipathd does not monitor multipath devices
      created externally while there are offline paths.")
  - Resolves: RHEL-82534


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-39
changelog:
  - Add 0145-multipath-tools-add-DellEMC-ME4-PowerVault-ME4-to-ha.patch
  - Add 0146-multipath-tools-add-HPE-as-vendor-for-OPEN-XP8-array.patch
  - Add 0147-multipath-tools-add-HP-HSVX740-to-hwtable.patch
  - Add 0148-multipath-tools-add-DellEMC-ME5-PowerVault-ME5-to-ha.patch
  - Add 0149-multipath-tools-add-HPE-MSA-Gen7-2070-2072-to-hwtabl.patch
    * Fixes RHEL-103109 ("Update multipath builtin config to add new
      device defaults")
  - Resolves: RHEL-103109


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-40
changelog:
  - Add 0150-libmpathpersist-retry-commands-on-other-paths-in-mpa.patch
  - Add 0151-libmpathpersist-check-released-key-against-the-reser.patch
  - Add 0152-multipathd-remove-thread-from-mpath_pr_event_handle.patch
  - Add 0153-libmpathpersist-remove-uneeded-wrapper-function.patch
  - Add 0154-libmpathpersist-reduce-log-level-for-persistent-rese.patch
  - Add 0155-libmpathpersist-remove-pointless-update_map_pr-ret-v.patch
  - Add 0156-multipathd-use-update_map_pr-in-mpath_pr_event_handl.patch
  - Add 0157-libmpathpersist-limit-changing-prflag-in-update_map_.patch
  - Add 0158-multipathd-Don-t-call-update_map_pr-unnecessarily.patch
  - Add 0159-libmpathpersist-remove-useless-function-send_prout_a.patch
  - Add 0160-libmpathpersist-fix-memory-leak-in-mpath_prout_rel.patch
  - Add 0161-limpathpersist-redesign-failed-release-workaround.patch
  - Add 0162-libmpathpersist-fail-the-release-if-all-threads-fail.patch
  - Add 0163-limpathpersist-Handle-changing-key-corner-case.patch
  - Add 0164-libmpathpersist-fix-command-keyword-ordering.patch
  - Add 0165-libmpathpersist-use-conf-timeout-for-updating-persis.patch
  - Add 0166-libmapthpersist-Handle-REGISTER-AND-IGNORE-changing-.patch
  - Add 0167-libmultipath-rename-prflag_value-enums.patch
  - Add 0168-libmpathpersist-use-a-switch-statement-for-prout-com.patch
  - Add 0169-libmpathpersist-Add-safety-check-for-preempting-on-k.patch
  - Add 0170-limpathpersist-remove-update_map_pr-code-for-NULL-pp.patch
  - Add 0171-libmpathpersist-move-update_map_pr-to-multipathd.patch
  - Add 0172-multipathd-clean-up-update_map_pr-and-mpath_pr_event.patch
  - Add 0173-libmpathpersist-clean-up-duplicate-function-declarat.patch
  - Add 0174-multipathd-wrap-setting-and-unsetting-prflag.patch
  - Add 0175-multipathd-unregister-PR-key-when-path-is-restored-i.patch
  - Add 0176-libmpathpersist-Fix-up-reservation_key-checking.patch
  - Add 0177-libmpathpersist-change-how-reservation-conflicts-are.patch
  - Add 0178-libmpathpersist-Clear-prkey-in-multipathd-before-unr.patch
  - Add 0179-libmpathpersist-only-clear-the-key-if-we-are-using-t.patch
  - Add 0180-libmpathpersist-Restore-old-reservation-key-on-failu.patch
  - Add 0181-libmpatpersist-update-reservation-key-before-checkin.patch
  - Add 0182-libmpathpersist-retry-on-conflicts-in-mpath_prout_co.patch
  - Add 0183-libmpathpersist-Don-t-always-fail-registrations-for-.patch
  - Add 0184-libmpathpersist-Don-t-try-release-workaround-for-inv.patch
  - Add 0185-libmpathpersist-Don-t-fail-RESERVE-commands-unnecess.patch
  - Add 0186-libmpathpersist-reregister-keys-when-self-preempting.patch
  - Add 0187-libmpathpersist-handle-updating-key-race-condition.patch
  - Add 0188-libmpathpersist-handle-preempting-all-registrants-re.patch
  - Add 0189-libmpathpersist-Fix-REGISTER-AND-IGNORE-while-holdin.patch
  - Add 0190-libmpathpersist-Handle-RESERVE-with-reservation-held.patch
  - Add 0191-libmpathpersist-use-check_holding_reservation-in-mpa.patch
  - Add 0192-libmpathpersist-Fix-unregistering-while-holding-the-.patch
  - Add 0193-libmpathpersist-Fix-race-between-restoring-a-path-an.patch
  - Add 0194-multipathd-Fix-tracking-of-old-PR-key.patch
    * Fixes RHEL-118515 ("There are many bugs in multipath's persistent
      reservation handling")
  - Resolves: RHEL-118515


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-41
changelog:
  - Add 0195-multipathd-Fix-race-while-registering-PR-key.patch
  - Add 0196-mpathpersist-Fix-REPORT-CAPABILITIES-output.patch
    * Fixes RHEL-118515 ("There are many bugs in multipath's persistent
      reservation handling")
  - Resolves: RHEL-118515


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-42
changelog:
  - Add 0197-multipath-tools-update-NFINIDAT-InfiniBox-config-in-.patch
    * Fixes RHEL-128396 ("Update the multipath.conf stanza for Infinidat
      storage [rhel-9]")
  - Resolves: RHEL-128396


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-43
changelog:
  - Add 0198-multipathd-print-path-offline-message-even-without-a.patch
    * Fixes RHEL-133814 ("log_checker_err is not printing messages
      repeatedly for failed path [rhel-9]")
  - Add 0199-libmultipath-improve-cleanup-of-uevent-queues-on-exi.patch
  - Add 0200-uevent_dispatch-use-while-in-wait-loop.patch
  - Add 0201-libmultipath-uevent_dispatch-process-uevents-one-by-.patch
  - Add 0202-libmultipath-uevent_listen-don-t-delay-uevents.patch
  - Add 0203-libmultipath-uevent-use-struct-to-pass-parameters-ar.patch
  - Add 0204-libmultipath-is_uevent_busy-check-servicing_uev-unde.patch
  - Add 0205-multipathd-make-multipathd-show-status-busy-checker-.patch
    * Fixes RHEL-135904 (VM reboot in RHOSP environment fails with error
      "Could not open '/dev/dm-95': No such file or directory")
  - Resolves: RHEL-133814
  - Resolves: RHEL-135904


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-44
changelog:
  - Add 0206-libmultipath-add-purge_disconnected-configuration-op.patch
  - Add 0207-multipathd-implement-purge-functionality-for-disconn.patch
    * Fixes RHEL-141291 ("Add purge_disconnected support to multipathd
      [rhel-9]")
  - Resolves: RHEL-141291


author: Benjamin Marzinski <bmarzins@redhat.com> - 0.8.7-45
changelog:
  - Add 0208-libmpathpersist-fix-register-retry-status-checking.patch
  - Add 0209-multipathd-remember-number-of-registered-keys-when-i.patch
  - Add 0210-libmpathpersist-fix-code-for-skipping-multipathd-pat.patch
    * Fixes RHEL-148462 ("Improve multipathd's handling of updating
      persistent reservations on restored paths. [rhel-9]")
  - Resolves: RHEL-148462


author: Arjun Shankar <arjun@redhat.com> - 2.6.4-6
changelog:
  - Re-work flex subpackages and provide shared libraries (#1327851):
  - Remove and obsolete the flex-devel subpackage containing static libraries
  - Provide shared libraries in a new subpackage named libfl2
  - Provide development files in a new subpackage named libfl-devel
  - Provide static libraries in a new subpackage named libfl-static


author: Peter Hutterer <peter.hutterer@redhat.com> - 1.19.3-6
changelog:
  - Add support for the Wacom Intuos Pro (RHEL-105483)
  - Rename existing patches for better order clarity


author: Richard Hughes <richard@hughsie.com> 0.1.6-1
changelog:
  - New upstream release
  - Fall back to the AliasId for validation
  - Fix jcat_context_verify_blob() to use self verify for checksums


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-1
changelog:
  - Update to new upstream release 1.4.0
    Resolves: RHEL-5367
  - Add a patch to fix auxiliary tests in FIPS mode
    Resolves: RHEL-2405
  - Add a patch to zeroize kcapi-hasher for FIPS 140-3
    Resolves: RHEL-15112
  - Add a patch to allow overriding target file in kcapi-hasher
    Resolves: RHEL-15298


author: Zoltan Fridrich <zfridric@redhat.com> - 1.4.0-2
changelog:
  - Backport fixes for kcapi-hasher target option
    Related: RHEL-15298
  - Fix kcapi tests in FIPS mode
    Resolves: RHEL-2405


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-13
changelog:
  - CVE-2025-64720: buffer overflow (RHEL-131594)
  - CVE-2025-65018: heap buffer overflow (RHEL-131603)
  - CVE-2025-66293: out-of-bounds read in png_image_read_composite (RHEL-133294)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-14
changelog:
  - fix CVE-2026-22801: heap buffer over-read in png_image_write_*bit (RHEL-147356)
  - fix CVE-2026-22695: heap buffer over-read in png_image_finish_read (RHEL-149000)


author: Michal Hlavinka <mhlavink@redhat.com> - 2:1.6.37-15.2
changelog:
  - fix CVE-2026-33416: use-after-free via pointer aliasing in png_set_tRNS and png_set_PLTE (RHEL-161448)


author: Stephan Bergmann <sbergman@redhat.com> - 1:7.1.8.1-11
changelog:
  - Resolves: rhbz#2210193 CVE-2023-0950 Array Index UnderFlow in Calc Formula
    Parsing
  - Resolves: rhbz#2210197 CVE-2023-2255 libreoffice: Remote documents loaded
    without prompt via IFrame
  - Resolves: rhbz#2208510 CVE-2023-1183 libreoffice: Arbitrary File Write


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.1
changelog:
  - Fix CVE-2026-4430 Conform AlignEngine parsing to what section 2.3.4.10 of
    the spec has
  - Resolves: RHEL-176576


author: Tomas Popela <tpopela@redhat.com> - 1:7.1.8.1-15.el9_8.2
changelog:
  - Fix CVE-2026-8357 Arbitrary code execution via heap buffer overflow in
    formula compilation
  - Resolves: RHEL-186062


author: Eduard Abdullin <eabdullin@almalinux.org> - 2.15.2-6.alma
changelog:
  - Add support for AlmaLinux Bug Tracker
  - Remove libreport-rhel-bugzilla and libreport-rhel-anaconda-bugzilla


author: Petr Pisar <ppisar@redhat.com> - 0.7.24-3
changelog:
  - Some static analysis fixes for unitialized structs
    Resolves: RHEL-25498
  - Fix a memory leak in parse_package() of repo conda (RHEL-25496)


author: Marek Blaha <mblaha@redhat.com> - 0.7.24-5
changelog:
  - Backport "choice rules: also do solver_choicerulecheck for package downgrades"
    Resolves: RHEL-141449


author: Kalev Lember <klember@redhat.com> - 3.39.92-2
changelog:
  - Split sysprof-capture library and header files out to sysprof-capture-devel
  - Update minimum required glib2 version


author: Benjamin Berg <bberg@redhat.com> - 1.0.25-1
changelog:
  - Update to 1.0.25
  - Fix a crash after libusb_exit API has been misused
  - Add patchset to fix covscan reports
    Resolves: #1938801


author: Benjamin Berg <bberg@redhat.com> - 1.0.26
changelog:
  - Pull in new upstream libusb containing important regression fixes
    Resolves: #2058730
    Resolves: #1938801


author: Kate Hsuan <hpa@redhat.com> - 1.0.30-1
changelog:
  - Update to upstream version 1.0.30 to include the major bug fixes
  - Include the necessary API for fwupd backporting to RHEL9.
    Resolves: RHEL-183213


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-5
changelog:
  - qemublocktest: Iterate all nodenames in 'testQemuDetectBitmaps' (RHEL-145770)
  - qemu: monitor: Detect list of bitmaps from 'qcow2' format specific data (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Fix check for existing bitmaps (RHEL-145770)
  - qemu: migration: Always offer block dirty bitmaps during migration (RHEL-145770)
  - qemuMigrationDstPrepareAnyBlockDirtyBitmaps: Always consider offered bitmaps (RHEL-145770)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-6
changelog:
  - qemu: Implement support for associating iommufd to hostdev (RHEL-126345)
  - qemu: Introduce privateData for hostdevs (RHEL-126345)
  - qemu: Support per-process memory accounting for iommufd (RHEL-126345)
  - qemu: open VFIO FDs from libvirt backend (RHEL-126345)
  - qemu: open iommufd FD from libvirt backend (RHEL-126345)
  - qemu: Update Cgroup, namespace, and seclabel for iommufd (RHEL-126345)
  - tests: qemuxmlconfdata: provide iommufd sample XML and CLI args (RHEL-126345)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-9
changelog:
  - qemu: capabilities: Probe properties of 'scsi-block' and 'scsi-generic' devices (RHEL-140614)
  - qemu: capabilities: Introduce QEMU_CAPS_DEVICE_SCSI_BLOCK_MIGRATE_PR (RHEL-140614)
  - RHEL-ONLY: backport test data for 'migrate-pr' capability of 'scsi-block' (RHEL-140614)
  - qemu: Implement support for persistent reservation migration control (RHEL-140614)
  - qemu: Extract disk setup done via QMP into a separate helper (RHEL-147866)
  - qemu: process: Rename 'qemuProcessSetupDiskThrottling' to 'qemuProcessSetupDisks' (RHEL-147866)
  - qemu: monitor: Extract block latency histogram stats into 'qemuBlockStats' (RHEL-147866)
  - Expose latency histograms via 'virConnectGetAllDomainStats' (RHEL-147866)
  - qemu: monitor: Add handlers for 'block-latency-histogram-set' (RHEL-147866)
  - docs: formatdomain: Fix indentation of docs for <disk><driver><statistics> element (RHEL-147866)
  - docs: formatdomain: Reword section about the '<statistics>' element under disk driver (RHEL-147866)
  - Introduce support for disk operation latency histogram collection (RHEL-147866)
  - qemu: Setup disk latency histograms on startup/hotplug/update (RHEL-147866)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-10
changelog:
  - qemu: Introduce QEMU_CAPS_OBJECT_IOMMUFD (RHEL-150353)
  - qemu: Move IOMMUFD validation to qemu_validate (RHEL-150353)
  - util: Move openning IOMMU device to viriommufd (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenIommuFd (RHEL-150353)
  - util: Move openning VFIO device to virpci (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioDeviceFd (RHEL-150353)
  - util: Use virPCIDevice as argument in virPCIDeviceGetVfioPath (RHEL-150353)
  - conf: Introduce virHostdevIsPCIDeviceWithIOMMUFD (RHEL-150353)
  - conf: Introduce virDomainDefHasPCIHostdevWithIOMMUFD (RHEL-150353)
  - qemu_domain: Add missing IOMMUFD cleanup (RHEL-150353)
  - qemu_process: Fix FD leak with multiple host devices using IOMMUFD (RHEL-150353)
  - qemu_process: Refactor qemuProcessOpenVfioFds (RHEL-150353)
  - qemuxmlconftest: Refactor host device preparation (RHEL-150353)
  - qemuxmlconftest: Rename and refactor testSetupHostdevPrivateData (RHEL-150353)
  - qemuxmlconftest: Set fake FD for IOMMUFD (RHEL-150353)
  - qemu: Convert IOMMUFD to qemuFDPassDirect (RHEL-150353)
  - qemu: Convert vfioDeviceFd to qemuFDPassDirect (RHEL-150353)
  - qemu_command: Don't use host property if IOMMUFD is used (RHEL-150353)
  - qemu: Save IOMMUFD state into status XML (RHEL-150353)
  - qemu_hotplug: Remove iommufd object if no longer needed (RHEL-150353)
  - qemu_command: Extract building IOMMUFD props to function (RHEL-150353)
  - qemu_hotplug: Add support to hotplug host device with IOMMUFD (RHEL-150353)
  - conf: Introduce iommufd enum for domaincaps (RHEL-138544)
  - qemu: Fill iommufd domain capability (RHEL-138544)
  - tests: properly mock VFIO and IOMMU checks (RHEL-138544)
  - iommufd: fix FD leak in case of error (RHEL-150353)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-11
changelog:
  - domain_conf: initialize network hostdev private data (RHEL-151953)
  - qemu_hotplug: enter monitor in order to rollback passed FD (RHEL-151953)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.1.el9_8
changelog:
  - conf: Parse hyperv features even for host-model (RHEL-151684)
  - qemu: Wire up new hyperv host-model mode behavior (RHEL-151684)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.2.el9_8
changelog:
  - Introduce EXPAND_CPU_FEATURES flag for domain capabilities (RHEL-154552)
  - qemu: Implement VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-154552)
  - virsh: Add --expand-cpu-features option for domcapabilities (RHEL-154552)
  - docs: Clarify host-model description in domain capabilities (RHEL-154552)
  - security_apparmor: Use g_auto* in AppArmorSetSecurityHostdevLabel (RHEL-159913)
  - security: Cleanup hostdev label error logic (RHEL-159913)
  - qemu: Fix IOMMUFD and VFIO security labels (RHEL-159913)
  - viriommufd: Set IOMMU_OPTION_RLIMIT_MODE only when running privileged (RHEL-159174)
  - conf: Move and rename virStorageSourceFDTuple object (RHEL-159174)
  - conf: Refactor virHostdevIsPCIDevice (RHEL-159174)
  - hypervisor: Fix virHostdevNeedsVFIO detection (RHEL-159174)
  - qemu: Expand call to qemuDomainNeedsVFIO (RHEL-159174)
  - qemu: Update qemuDomainNeedsVFIO to ignore PCI hostdev with IOMMUFD (RHEL-159174)
  - src: Use virHostdevIsPCIDeviceWith* to check for IOMMUFD (RHEL-159174)
  - conf: Introduce domain iommufd element (RHEL-159174)
  - qemu: Implement iommufd (RHEL-159174)
  - conf: Add iommufd fdgroup support (RHEL-159174)
  - qemu: Implement iommufd fdgroup (RHEL-159174)
  - tests: Add iommufd fdgroup test (RHEL-159174)
  - hypervisor: Call virWaitForDevices() after detaching host devices (RHEL-159174)


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-12.3.el9_8
changelog:
  - cpu_conf: Introduce virCPUDefSortFeatures (RHEL-178822)
  - qemu_capabilities: Split virQEMUCapsFillDomainCPUCaps (RHEL-178822)
  - qemu: Move domain caps flags handling to virQEMUCapsFillDomainCPUHostModel (RHEL-178822)
  - qemu_capabilities: Always sort features in host-model CPU (RHEL-178822)
  - qemu_capabilities: Use g_autoptr in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Split conditions in virQEMUCapsInitHostCPUModel (RHEL-178822)
  - qemu_capabilities: Cache expanded CPU (RHEL-178822)
  - domaincapstest: Test EXPAND_CPU_FEATURES flag (RHEL-178822)
  - util: Publish and mock virHostCPUGetMSRFromKVM (RHEL-178822)
  - cpu_x86: Introduce virCPUx86DataAddMSR (RHEL-178822)
  - cpu: Introduce virCPUUpdateFeatures (RHEL-178822)
  - Fix documentation of VIR_CONNECT_GET_DOMAIN_CAPABILITIES_EXPAND_CPU_FEATURES (RHEL-178822)
  - Introduce VIR_CONNECT_GET_DOMAIN_CAPABILITIES_SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - virsh: Add --supported-cpu-features option for domcapabilities (RHEL-178822)
  - domaincapstest: Test SUPPORTED_CPU_FEATURES flag (RHEL-178822)
  - qemu_capabilities: Fix domain capabilities on AMD CPUs (RHEL-178822)
  - distro: Replace old gating with tmt


author: Jiri Denemark <jdenemar@redhat.com> - 11.10.0-4
changelog:
  - qemuSecurityMoveImageMetadata: Move seclabels only to virStorageSource of same type (RHEL-140624)
  - qemuDomainSetThrottleGroup: Enforce non-zero 'groupname' string length (RHEL-144010)
  - qemuDomainSetBlockIoTuneField: Move setting of 'group_name' out of the loop (RHEL-144010)
  - qemuDomainSetThrottleGroup: Always honour thottle group name passed as argument (RHEL-144010)
  - qemuDomainSetThrottleGroup: Don't put group name into the 'tunable' event twice (RHEL-144010)
  - qemuSnapshotDiskHasBackingDisk: Avoid call of virStorageSourceIsSameLocation with NULL argument (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Remove stale comment (RHEL-144090)
  - qemuSnapshotDiskHasBackingDisk: Use proper 'max_depth' when calling 'virStorageSourceGetMetadata' (RHEL-144090)
  - virDomainSnapshotDefAssignExternalNames: Improve error message (RHEL-144090)
  - qemuSnapshotUpdateBackingStore: Retry as curent user if qemu-img fails (RHEL-144090)


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-6
changelog:
  - Add fix for mzbz#1819244
  - Fix tools subpackage dependency
  - Bump the release to "6" to accommodate the 9.1.0.z release bumps


author: Tomas Popela <tpopela@redhat.com> - 1.2.0-7
changelog:
  - Bump the release to "7" to accommodate the 9.1.0.z release bumps as
    libwebp-1.2.0-6.el9 < libwebp-1.2.0-6.el9_1


author: RHEL Packaging Agent <jotnar@redhat.com> - 0.3.24-1
changelog:
  - Rebase to 0.3.24
  - Add missing libzstd-devel BuildRequires
  - Add missing files to the %files tests section
  - Resolves: RHEL-116442


author: Marian Csontos <mcsontos@redhat.com> - 2.03.28-5
changelog:
  - Fix temporary LVs not cleaned when converting in use LV to a thin pool.
  - Check FS resize is supported before extending LV.
  - Fix issue affecting memory locking before suspend (2.03.27).


author: Marian Csontos <mcsontos@redhat.com> - 2.03.32-2
changelog:
  - Fix vgremove hanging immediately after lockstart.
  - Add repair option for RAID volumes with too many transiently failed devices.


author: José Expósito <jexposit@redhat.com> - 24.1.2-3
changelog:
  - Match mesa-libEGL version
    Cherry-picked from: https://src.fedoraproject.org/rpms/mesa/pull-request/24
    Resolves: https://issues.redhat.com/browse/RHEL-50229


author: Koichiro Iwao <meta@almalinux.org> - 24.1.2-3.alma.1
changelog:
  - Enable vc4 and v3d for Raspberry Pi graphics in AlmaLinux (Resolves:
    https://github.com/AlmaLinux/raspberry-pi/issues/32)


author: Koichiro Iwao <meta@almalinux.org> - 24.1.2-3.alma.2
changelog:
  - Add support for Raspberry Pi 2712D0 stepping
    Resolves: https://bugs.almalinux.org/view.php?id=497


author: José Expósito <jexposit@redhat.com> - 24.2.8-2
changelog:
  - AMD Navi4x support
    Backport fixes for radeonsi and disable GFX12 on radv
    Resolves: https://issues.redhat.com/browse/RHEL-53419


author: Anusha Srivatsa <asrivats@redhat.com> - 24.2.8-3
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-107885


author: Anusha Srivatsa <asrivats@redhat.com> - 25.0.7-2
changelog:
  - NV dGFX fix for firefox crashing
    Backport fixes for NV dGFX driver crashing firefox
    Resolves: https://issues.redhat.com/browse/RHEL-93219


author: Konstantin Kostiuk <kkostiuk@redhat.com> - 0.42.2-3
changelog:
  - Bump pixman version 0.42.2
  - Drop DesktopQE gating 
  - Fix CVEs: CVE-2022-44638
  - Resolves: RHEL-5013


author: Matej Mužila <mmuzila@redhat.com> - 1.2.11-34
changelog:
  - Fix heap-based buffer over-read or buffer overflow in inflate in inflate.c
  - Resolves: CVE-2022-37434


author: Lukas Javorsky <ljavorsk@redhat.com> - 1.2.11-37
changelog:
  - Rebased Power 8 optimization patches
  - Fix for Unnecessary IFUNC resolver for crc32_z
  - Fix for python3.11 broken libxml2 and lxml on s390x


author: Olivier Fourdan <ofourdan@redhat.com> - 40.9-31
changelog:
  - Backport linux-dmabuf v4 support to restore hardware acceleration
    in Xwayland 24.1 with Mesa 25.2
    Resolves: RHEL-129832


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.3-1
changelog:
  - Rebase to 1.38.3 (along stable branch)
  - Send the last error to the NBD client
    resolves: RHEL-50664


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-6
changelog:
  - Add extra system call checking and debugging to nbdkit-file-plugin
    resolves: RHEL-85510
  - Allow nbdkit-file-plugin to zero and trim block devices
    resolves: RHEL-89353


author: Richard W.M. Jones <rjones@redhat.com> - 1.38.5-10
changelog:
  - CVE-2025-47711 denial of service attack by client sending maximum size block
    status
  - CVE-2025-47712 denial of service attack by client sending large unaligned
    size block status
    resolves: RHEL-95814


author: Miroslav Lichvar <mlichvar@redhat.com> 6.2-9.20210508
changelog:
  - fix buffer overflow on terminfo with too many capabilities (CVE-2023-29491)
  - ignore TERMINFO and HOME environment variables if running as root (#2211666)


author: Jan Macku <jamacku@redhat.com> - 10.11.8-1
changelog:
  - netconsole: var/lock -> run/lock
  - netconsole: source sysconfig/network only if it exists
  - netconsole: remove unused variables
  - netconsole: remove trailing whitespaces
  - sync spec with c9s


author: François Cami <fcami@fedoraproject.org> - 1.19.1-9
changelog:
  - Fix FTBFS (rhbz#1865148)
  - Set __cmake_in_source_build
  - BR qt5-qtbase-devel to keep the GUI frontend


author: Dmitry Belyavskiy <dbelyavs@redhat.com> - 8.7p1-45
changelog:
  - Fix missing error codes set and invalid error code checks in OpenSSH. It
    prevents memory exhaustion attack and a MITM attack when VerifyHostKeyDNS
    is on (CVE-2025-26465).
    Resolves: RHEL-78700


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-2
changelog:
  - Fix implicit destination path selection when source path ends with ".."
    Resolves: RHEL-119515
  - Canonicalize username when matching a user
    Resolves: RHEL-118372


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-3
changelog:
  - Enable support for DSA keys
    Resolves: RHEL-127624
  - CVE-2025-61984: Reject usernames with control characters
    Resolves: RHEL-133959
  - CVE-2025-61985: Reject URL-strings with NULL characters
    Resolves: RHEL-133960


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-5
changelog:
  - CVE-2026-3497: Fix information disclosure or denial of service due
    to uninitialized variables in gssapi-keyex
    Resolves: RHEL-155824


author: Zoltan Fridrich <zfridric@redhat.com> - 9.9p1-7
changelog:
  - CVE-2026-35385: Fix privilege escalation via scp legacy protocol
    when not in preserving file mode
    Resolves: RHEL-164753
  - CVE-2026-35388: Add connection multiplexing confirmation for proxy-mode
    multiplexing sessions
    Resolves: RHEL-166250
  - CVE-2026-35387: Fix incomplete application of PubkeyAcceptedAlgorithms
    and HostbasedAcceptedAlgorithms with regard to ECDSA keys
    Resolves: RHEL-166234
  - CVE-2026-35414: Fix mishandling of authorized_keys principals option
    Resolves: RHEL-166202
  - CVE-2026-35386: Add validation rules to usernames and hostnames
    set for ProxyJump/-J on the commandline
    Resolves: RHEL-166218


author: Peng Wu <pwu@redhat.com> - 1.48.7-3
changelog:
  - Update pango-emoji-table.h for emoji 14 support
  - Add pango-update-emoji.patch
  - Resolves: #2119674


author: Paul Howarth <paul@city-fan.org> - 1.22-1
changelog:
  - Update to 1.22
    - Removed embedded copy of Config::AutoConf from distro.; instead, this is
      now a configure phase prereq. (GH#19)
    - Moved list of constants in libmagic that we care about to one module (GH#20)
    - Add support for setting libmagic processing limits (GH#15, GH#22)
    - Add two class methods that provide introspection on the available limit
      processing parameters, max_param_constant() and limit_key_is_supported()
      (GH#24)
    - Check all libmagic function return values properly and croak on failure
      (GH#21)
    - Switched to using GitHub issues
  - Package CONTRIBUTING.md


author: Paul Howarth <paul@city-fan.org> - 1.23-1
changelog:
  - Update to 1.23
    - Fixed a bug with the Makefile.PL that caused every call to "make" to
      recompile the object file for the package's XS code (GH#28)


author: Tom Stellard <tstellar@redhat.com> - 1.8-3
changelog:
  - Spec file cleanups: Use make_build and make_install macros, use NO_PACKLIST=1
    - https://docs.fedoraproject.org/en-US/packaging-guidelines/#_parallel_make
    - https://fedoraproject.org/wiki/Perl/Tips#ExtUtils::MakeMaker


author: Paul Howarth <paul@city-fan.org> - 2.100-1
changelog:
  - Update to 2.100
    - Declare vars with our instead of use vars (GH#7)
    - Quote $VERSION to preserve formatting (GH#6)
  - Use %license unconditionally


author: Tomas Halman <thalman@redhat.com> - 2.7.0-12
changelog:
  - Fixing CVE-2025-47151
    Resolves: RHEL-126685 CVE-2025-47151 lasso: Type confusion in Entr'ouvert Lasso


author: Jakub Jelen <jjelen@redhat.com> - 1.1.1-2
changelog:
  - Move pinentry-tty to separate subpackage (#1782442)
  - Update the wrapper selecting the appropriate version (#1918969)


author: Neal Gompa <ngompa@centosproject.org> - 0.3.40-1
changelog:
  - Update to version 0.3.40 which drops media-session service for WirePlumber
    Resolves: rhbz#2022694


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-4
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/4978898)
  - Resolves: #2124676


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/d520a5c)
  - Resolves: #2136845


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-7
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/35c0df3)
  - Resolves: #2120436


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/6742838)
  - Resolves: #2149776


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/bfac4a5)
  - Resolves: #2152026


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-10
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/28df097)
  - Resolves: #2158636


author: Jindrich Novy <jnovy@redhat.com> - 2:4.2.0-11
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.2.0-rhel
    (https://github.com/containers/podman/commit/1a116d1)
  - Resolves: #2166104


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-1
changelog:
  - update to latest content of https://github.com/containers/podman/releases/tag/4.6.1
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-2
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/1b2fadd)
  - Resolves: #2232127


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-3
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/8bb0204)
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-5
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/ea33dce)
  - Related: #2176063


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-6
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/68e7ae0)
  - Related: Jira:RHEL-2785
  - Related: Jira:RHEL-7452


author: Lokesh Mandvekar <lsm5@redhat.com> - 2:4.6.1-7
changelog:
  - Rebuild for following CVEs:
    CVE-2023-39318 CVE-2023-39319 CVE-2023-39321 CVE-2023-39322 CVE-2023-29409
  - Related: Jira:RHEL-2785
  - Related: Jira:RHEL-7452


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-8
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/227b84e)
  - Resolves: RHEL-20911


author: Jindrich Novy <jnovy@redhat.com> - 2:4.6.1-9
changelog:
  - update to the latest content of https://github.com/containers/podman/tree/v4.6.1-rhel
    (https://github.com/containers/podman/commit/22c2308)
  - Resolves: RHEL-20491


author: Tomáš Hrnčiar <thrnciar@redhat.com> - 2.8.6-6
changelog:
  - Add automatically generated Obsoletes tag with the python39- prefix
    for smoother upgrade from RHEL8
  - Add manual Obsoletes for python39-psycopg2-doc
  - Related: rhbz#1990421


author: Michal Fabik <mfabik@redhat.com> 0.35-1
changelog:
  - New upstream version
   - Fix leaks in koops stacktrace- and report-handling code
   - Replace utility code with GLib functions
   - Fix unit test portability issue
   - Add build dependency on make


author: Michal Fabik <mfabik@redhat.com> 0.38-1
changelog:
  - New upstream version
   - lib: Use GLib for computing SHA-1 digests
   - sr_distances_cluster_objects: Check arg safety


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-12
changelog:
  - kvm-block-Improve-comments-in-BlockLimits.patch [RHEL-132989]
  - kvm-block-Expose-block-limits-for-images-in-QMP.patch [RHEL-132989]
  - kvm-qemu-img-info-Optionally-show-block-limits.patch [RHEL-132989]
  - kvm-qemu-img-info-Add-cache-mode-option.patch [RHEL-132989]
  - kvm-hw-intc-ioapic-Fix-ACCEL_KERNEL_GSI_IRQFD_POSSIBLE-t.patch [RHEL-140187]
  - kvm-q35-increase-default-tseg-size.patch [RHEL-139057]
  - Resolves: RHEL-132989
    (Expose block limits of block nodes in QMP and qemu-img [rhel-9])
  - Resolves: RHEL-140187
    (Intel IOMMU VM freezes: "call_irq_handler: 3.37 No irq handler for vector"[rhel-9.8])
  - Resolves: RHEL-139057
    ([qemu, rhel-9] increase default TSEG size)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-13
changelog:
  - kvm-vhost-user-make-vhost_set_vring_file-synchronous.patch [RHEL-147422]
  - kvm-hw-s390x-Fix-a-possible-crash-with-passed-through-vi.patch [RHEL-130620]
  - Resolves: RHEL-147422
    (virtiofs: processes become stuck in request_wait_answer on virtiofs mounts)
  - Resolves: RHEL-130620
    (VM crashes during boot when virtio device is attached through vfio_ccw [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-14
changelog:
  - kvm-rbd-Run-co-BH-CB-in-the-coroutine-s-AioContext.patch [RHEL-67115]
  - kvm-curl-Fix-coroutine-waking.patch [RHEL-67115]
  - kvm-block-io-Take-reqs_lock-for-tracked_requests.patch [RHEL-67115]
  - kvm-qcow2-Re-initialize-lock-in-invalidate_cache.patch [RHEL-67115]
  - kvm-qcow2-Fix-cache_clean_timer.patch [RHEL-67115]
  - Resolves: RHEL-67115
    ([network-storage][rbd][core-dump]installation of guest failed sometimes with multiqueue enabled[rhel9.6])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-15
changelog:
  - kvm-scsi-generalize-scsi_SG_IO_FROM_DEV-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-add-error-reporting-to-scsi_SG_IO.patch [RHEL-149396]
  - kvm-scsi-track-SCSI-reservation-state-for-live-migration.patch [RHEL-149396]
  - kvm-scsi-save-load-SCSI-reservation-state.patch [RHEL-149396]
  - kvm-docs-add-SCSI-migrate-pr-documentation.patch [RHEL-149396]
  - Resolves: RHEL-149396
    (Migrate SCSI PR state and preempt reservation upon live migration [rhel-9])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-16
changelog:
  - kvm-block-Never-drop-BLOCK_IO_ERROR-with-action-stop-for.patch [RHEL-151679]
  - Resolves: RHEL-151679
    ([rhel-9.8] Regression in BLOCK_IO_ERROR event delivery with (w|r)error setting of 'stop' or 'enospc' due to event rate limiting)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17
changelog:
  - kvm-mirror-Fix-missed-dirty-bitmap-writes-during-startup.patch [RHEL-155947 RHEL-155948]
  - kvm-linux-aio-Put-all-parameters-into-qemu_laiocb.patch [RHEL-154174]
  - kvm-linux-aio-Resubmit-tails-of-short-reads-writes.patch [RHEL-154174]
  - kvm-block-io_uring-avoid-potentially-getting-stuck-after.patch [RHEL-154174]
  - kvm-io-uring-Resubmit-tails-of-short-writes.patch [RHEL-154174]
  - Resolves: RHEL-155947
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9.8])
  - Resolves: RHEL-155948
    (Mirror job can miss writes during startup, corrupting the copy [rhel-9])
  - Resolves: RHEL-154174
    (qemu-kvm: disk writes of fewer bytes than requested is a retry condition, not necessarily an indication of ENOSPC [rhel-9.8])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.1
changelog:
  - kvm-scsi-Don-t-consider-LOGICAL-UNIT-NOT-SUPPORTED-guest.patch [RHEL-164534]
  - Resolves: RHEL-164534
    (qemu-kvm doesn't retry SG-IO on 05/25/00 (ILLEGAL REQUEST / LOGICAL UNIT NOT SUPPORTED) [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.2
changelog:
  - kvm-scsi-adjust-error_prepend-formatting.patch [RHEL-166008]
  - kvm-scsi-always-send-valid-PREEMPT-TYPE-field.patch [RHEL-166008]
  - kvm-scsi-register-again-after-PREEMPT-without-reservatio.patch [RHEL-166008]
  - Resolves: RHEL-166008
    (live migration failed the VM just register key only [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.3
changelog:
  - kvm-accel-mshv-Remove-remap-overlapping-mappings-code.patch [RHEL-184951]
  - kvm-accel-mshv-implement-cpu_thread_is_idle-hook.patch [RHEL-184951]
  - Resolves: RHEL-184951
    (MSHV backport onto QEMU 10.1.0 is not able to launch MSHV guests [rhel-9.8.z])


author: Eduard Abdullin <eabdullin@almalinux.org> - 17:10.1.0-17.3.alma.1
changelog:
  - Enable building for ppc64le
  - Don't remove slof.bin for ppc64le
  - usb: add config options for hub and hid devices for ppc
  - Remove pnv_chip_find_core calls from SPRD helpers
  - Remove pre-3.0 migration from spapr_compat_rhel7_6


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-17.el9_8.4
changelog:
  - kvm-virtio-blk-add-missing-VIRTIO_BLK_T_SCSI_CMD-size-ch.patch [RHEL-184527]
  - Resolves: RHEL-184527
    (CVE-2026-48914 qemu-kvm: Heap buffer overflow in virtio-blk SCSI request handling [rhel-9.8.z])


author: Danilo de Paula <ddepaula@redhat.com> - 10.1.0-17.el9_8.5
changelog:
  - kvm-file-posix-populate-pwrite_zeroes_alignment.patch [RHEL-207387]
  - kvm-block-use-pwrite_zeroes_alignment-when-writing-first.patch [RHEL-207387]
  - kvm-iotests-add-Linux-loop-device-image-creation-test.patch [RHEL-207387]
  - Resolves: RHEL-207387
    (qemu-img create/convert fails on target block device with 4k sector size [rhel-9.8.z])


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-9
changelog:
  - kvm-pcie_sriov-make-pcie_sriov_pf_exit-safe-on-non-SR-IO.patch [RHEL-131144]
  - kvm-accel-Add-Meson-and-config-support-for-MSHV-accelera.patch [RHEL-132193]
  - kvm-target-i386-emulate-Allow-instruction-decoding-from-.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-x86-decoder-emu-implementation.patch [RHEL-132193]
  - kvm-hw-intc-Generalize-APIC-helper-names-from-kvm_-to-ac.patch [RHEL-132193]
  - kvm-include-hw-hyperv-Add-MSHV-ABI-header-definitions.patch [RHEL-132193]
  - kvm-linux-headers-linux-Add-mshv.h-headers.patch [RHEL-132193]
  - kvm-accel-mshv-Add-accelerator-skeleton.patch [RHEL-132193]
  - kvm-accel-mshv-Register-memory-region-listeners.patch [RHEL-132193]
  - kvm-accel-mshv-Initialize-VM-partition.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-creation-and-execution-loop.patch [RHEL-132193]
  - kvm-treewide-rename-qemu_wait_io_event-qemu_wait_io_even.patch [RHEL-132193]
  - kvm-accel-mshv-Add-vCPU-signal-handling.patch [RHEL-132193]
  - kvm-target-i386-mshv-Add-CPU-create-and-remove-logic.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_store_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_standard_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_get_special_regs.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_arch_put_registers.patch [RHEL-132193]
  - kvm-target-i386-mshv-Set-local-interrupt-controller-stat.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-CPUID-entries-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Register-MSRs-with-MSHV.patch [RHEL-132193]
  - kvm-target-i386-mshv-Integrate-x86-instruction-decoder-e.patch [RHEL-132193]
  - kvm-target-i386-mshv-Write-MSRs-to-the-hypervisor.patch [RHEL-132193]
  - kvm-target-i386-mshv-Implement-mshv_vcpu_run.patch [RHEL-132193]
  - kvm-accel-mshv-Handle-overlapping-mem-mappings.patch [RHEL-132193]
  - kvm-qapi-accel-Allow-to-query-mshv-capabilities.patch [RHEL-132193]
  - kvm-target-i386-mshv-Use-preallocated-page-for-hvcall.patch [RHEL-132193]
  - kvm-docs-Add-mshv-to-documentation.patch [RHEL-132193]
  - kvm-MAINTAINERS-Add-maintainers-for-mshv-accelerator.patch [RHEL-132193]
  - kvm-accel-mshv-initialize-thread-name.patch [RHEL-132193]
  - kvm-accel-mshv-use-return-value-of-handle_pio_str_read.patch [RHEL-132193]
  - Resolves: RHEL-131144
    (qemu crash after hot-unplug disk from the multifunction enabled bus [RHEL.9.8])
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-10
changelog:
  - kvm-monitor-generalize-query-mshv-info-mshv-to-query-acc.patch [RHEL-132193]
  - Resolves: RHEL-132193
    ([rhel 9.8]L1VH qemu downstream initial merge RHEL9)


author: Jon Maloy <jmaloy@redhat.com> - 10.1.0-11
changelog:
  - kvm-block-Fix-BDS-use-after-free-during-shutdown.patch [RHEL-138240]
  - Resolves: RHEL-138240
    (QEMU crashes when stopping source VM during live migration [rhel-9])


author: Jan Grulich <jgrulich@redhat.com> - 5.15.9-2
changelog:
  - Assimp: Fix heap-based overflow in Assimp::LWO::AnimResolver::UpdateAnimRangeSetup
    Resolves: RHEL-104999
  - Assimp: Fix heap-based overflow in Assimp::ASE::Parser::ParseLV4MeshBonesVertices
    Resolves: RHEL-105004


author: Jan Grulich <jgrulich@redhat.com> - 5.15.2-9
changelog:
  - Sync with Fedora:
    - sync kde/5.15 branch fixes
    - pull in candidate fix QTBUG-83890
    Resolves: bz#1988934


author: Clark Williams <williams@redhat.com> - 2.5-1
changelog:
  - remove strip of realtime-entsk and generate debuginfo
  - ensure all files have valid SPDX license identifiers
  - remove Red Hat Makefile targets and specfile
  - Makefile cleanups and added .gitignore
  - drop the 'v' in the version string for the tarball
  - Makefile: add options for passing annocheck
  - Bump version to 2.5
  Resolves: RHEL-30179


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-31
changelog:
  - Fix potential use of uninitialized pipe array (RHEL-22604)
  - Fix potential use of uninitialized pgp struct (RHEL-22605)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)
  - Add SourceLicense tag to spec syntax (RHEL-28798)
  - Talk about rpmsign in the rpmsign(8) man page (RHEL-40895)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-33
changelog:
  - Fix root relocation regression (RHEL-28967)
  - Don't confuse OpenScanHub with false array overrun (RHEL-22607)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-35
changelog:
  - Fix %patch N applying Patch0 implicitly (RHEL-6294)
  - Issue deprecation warning for number-less %patch (RHEL-6294)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-37
changelog:
  - Allow parametric macros to opt out of option processing (RHEL-67161)
  - Report unsafe symlinks during installation as a specific case (RHEL-33393)
  - Fix FA_TOUCH'ed files getting removed on failed update (RHEL-63070)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-38
changelog:
  - Add support for spec local file attributes and generators (RHEL-52772)
  - Store configurable digest(s) on packages in rpmdb (RHEL-35619)
  - Fix a hard link race condition in brp-strip (RHEL-74011)


author: Michal Domonkos <mdomonko@redhat.com> - 4.16.1.3-40
changelog:
  - Improve error handling on keystore load (RHEL-114837)
  - Sort files before passing to file attr dependency generators (RHEL-95376)


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.0-2
changelog:
  - properly conflict with pacemaker not providing sync-default we need
    Resolves: rhbz#1979961
    Resolves: rhbz#1979573


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.1-2
changelog:
  - obviously autoconf is defining runstatedir - but with a
    wrong default - directly hand it over to configure
    and skip --with-runstatedir implemented in configure.ac
    for older versions of autoconf

    Resolves: rhbz#2011707


author: Klaus Wenninger <kwenning@redhat.com> - 1.5.2-1
changelog:
  - rebase to upstream v1.5.2
  - convert license naming to SPDX
  - make static analysis happy with a few checks & rearanges with
    dynamic-memory-management

    Resolves: rhbz#2168579


author: Pavel Raiskup <praiskup@redhat.com> - 1.6-1
changelog:
  - new upstream release
  - drop WITH_SELINUX knob and selinux patches, there's built-in support now
  - drop several patches which were incorporated upstream, except for
    changewarnSegv patch (did not apply, and not needed nowadays)


author: Tomas Korbar <tkorbar@redhat.com> - 1.2.0-11
changelog:
  - CVE-2020-23903 speex: divide by zero in read_samples() via crafted WAV file
  - Resolves: CVE-2020-23903


author: systemd maintenance team <systemd-maint@redhat.com> - 250-4
changelog:
  - udev/net-setup-link: change the default MACAddressPolicy to "none" (#2009237)
  - man: mention System Administrator's Guide in systemctl manpage (#1982596)
  - Net naming scheme for RHEL-9.0 (#2052106)
  - core: decrease log level of messages about use of KillMode=none (#2013213)
  - ci: replace apt-key with signed-by (#2013213)
  - ci: fix clang-13 installation (#2013213)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-7
changelog:
  - test: check systemd RPM macros (#2017035)
  - test: do not assume x86-64 arch in TEST-58-REPART (#2017035)
  - tests: add repart tests for block devices with 1024, 2048, 4096 byte sector sizes (#2017035)
  - test: accept both unpadded and padded partition sizes (#2017035)
  - test: lvm 2.03.15 dropped the static autoactivation (#2017035)
  - test: accept GC'ed units in newer LVM (#2017035)
  - shared: Add more dlopen() tests (#2017035)
  - systemctl: Show how long a service ran for after it exited in status output (#2017035)
  - time-util: introduce TIMESTAMP_UNIX (#2017035)
  - systemctl,man: update docs for `--timestamp=` (#2017035)
  - systemctl: make `--timestamp=` affect the `show` verb as well (#2017035)
  - tests: allow running all the services with SYSTEMD_LOG_LEVEL (#2017035)
  - coredump: raise the coredump save size on 64bit systems to 32G (and lower it to 1G on 32bit systems) (#2017035)
  - repart: fix sector size handling (#2017035)
  - mkdir: allow to create directory whose path contains symlink (#2017035)
  - mkdir: CHASE_NONEXISTENT cannot used in chase_symlinks_and_stat() (#2017035)
  - meson: move efi file lists closer to where they are used (#2017035)
  - meson: move efi summary() section to src/boot/efi (#2017035)
  - meson: report SBAT settings (#2017035)
  - boot: Build BCD parser only on arches supported by Windows (#2017035)
  - meson: Remove efi-cc option (#2017035)
  - meson: Get objcopy location from compiler (#2017035)
  - meson: Use files() for source lists for boot and fundamental (#2017035)
  - meson: Use files() for tests (#2017035)
  - tests: add fuzz-bcd (#2017035)
  - meson: Use files() for fuzzers (#2017035)
  - meson: Add check argument to remaining run_command() calls (#2017035)
  - meson: Use echo to list files (#2017035)
  - test: add a test for mkdir_p() (#2017035)
  - util: another set of CVE-2021-4034 assert()s (#2017035)
  - basic: update CIFS magic (#2017035)
  - shared: be extra paranoid and check if argc > 0 (#2017035)
  - core: check if argc > 0 and argv[0] is set (#2017035)
  - core: check argc/argv uncoditionally (#2017035)
  - test: temporary workaround for #21819 (#2017035)
  - test: don't leak local variable to outer scopes (#2017035)
  - tree-wide: don't use strjoina() on getenv() values (#2017035)
  - man: clarify Environmentfile format (#2017035)
  - test-load-fragment: add a basic test for config_parse_unit_env_file() (#2017035)
  - core/execute: use _cleanup_ in exec_context_load_environment() (#2017035)
  - test-env-file: add tests for quoting in env files (#2017035)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-8
changelog:
  - core: shorten long unit names that are based on paths and append path hash at the end (#2083493)
  - tests: add test case for long unit names (#2083493)
  - tests: reflect that we can now handle devices with very long sysfs paths (#2083493)
  - test: extend the "hashed" unit names coverage a bit (#2083493)
  - Revert "kernel-install: also remove modules.builtin.alias.bin" (#2065061)
  - Revert "kernel-install: prefer /boot over /boot/efi for $BOOT_ROOT" (#2065061)
  - kernel-install: 50-depmod: port to /bin/sh (#2065061)
  - kernel-install: 90-loaderentry: port to /bin/sh (#2065061)
  - kernel-install: fix shellcheck (#2065061)
  - kernel-install: port to /bin/sh (#2065061)
  - kernel-install: 90-loaderentry: error out on nonexistent initrds instead of swallowing them quietly (#2065061)
  - kernel-install: don't pull out KERNEL_IMAGE (#2065061)
  - kernel-install: prefer /boot over /boot/efi for $BOOT_ROOT (#2065061)
  - kernel-install: also remove modules.builtin.alias.bin (#2065061)
  - kernel-install: add new variable $KERNEL_INSTALL_INITRD_GENERATOR (#2065061)
  - kernel-install: k-i already creates $ENTRY_DIR_ABS, no need to do it again (#2065061)
  - kernel-install: prefix errors with "Error:", exit immediately (#2065061)
  - kernel-install: add "$KERNEL_INSTALL_STAGING_AREA" directory (#2065061)
  - kernel-install: add missing log line (#2065061)
  - kernel-install: don't try to persist used machine ID locally (#2065061)
  - kernel-install: add a new $ENTRY_TOKEN variable for naming boot entries (#2065061)
  - kernel-install: only generate systemd.boot_id= in kernel command line if used for naming the boot loader spec files/dirs (#2065061)
  - kernel-install: search harder for kernel image/initrd drop-in dir (#2065061)
  - kernel-install: add new "inspect" verb, showing paths and parameters we discovered (#2065061)
  - ci(Mergify): configuration update (#2087652)
  - ci(Mergify): fix copy&paste bug (#2087652)
  - shared: Fix memory leak in bus_append_execute_property() (#2087652)
  - fuzz: no longer skip empty files (#2087652)
  - networkctl: open the bus just once (#2087652)
  - json: align table (#2087652)
  - fuzz-json: optionally allow logging and output (#2087652)
  - shared/json: reduce scope of variables (#2087652)
  - fuzz-json: also do sorting and normalizing and other easy calls (#2087652)
  - shared/json: wrap long comments (#2087652)
  - shared/json: fix memory leak on failed normalization (#2087652)
  - shared/json: add helper to ref first, unref second (#2087652)
  - basic/alloc-util: remove unnecessary parens (#2087652)
  - fuzz-json: also try self-merge operations (#2087652)
  - shared/json: fix another memleak in normalization (#2087652)
  - shared/json: fix memleak in sort (#2087652)
  - execute: fix resource leak (#2087652)
  - tests: ignore dbus-broker-launcher (#2087652)
  - core/timer: fix memleak (#2087652)
  - timedatectl: fix a memory leak (#2087652)
  - test: fix file descriptor leak in test-psi-util (#2087652)
  - test: fix file descriptor leak in test-tmpfiles.c (#2087652)
  - test: fix file descriptor leak in test-fs-util (#2087652)
  - test: fix file descriptor leak in test-oomd-util (#2087652)
  - test: fix file descriptor leak in test-catalog (#2087652)
  - test: make masking of supplementary services configurable (#2087652)
  - test: fuzz our dbus interfaces with dfuzzer (#2087652)
  - test: skip TEST-21-DFUZZER without ASan (#2087652)
  - core: annotate Reexecute() as NoReply (#2087652)
  - test: always force a new image for dfuzzer (#2087652)
  - test: make dfuzzer less verbose (#2087652)
  - test: drop the at_exit() coredump check (#2087652)
  - test: make the shutdown routine a bit more "robust" (#2087652)
  - tree-wide: drop manually-crafted message for missing variables (#2087652)
  - test: allow overriding $QEMU_MEM when running w/ ASan (#2087652)
  - test: don't test buses we don't ship (#2087652)
  - shutdown: get only active md arrays. (#2047682)
  - bus: Use OrderedSet for introspection (#2068131)
  - logind-session-dbus: allow to set display name via dbus (#2100340)
  - ci: limit which env variables we pass through `sudo` (#2087652)
  - ci(Mergify): Add `ci-waived` logic (#2087652)
  - json: use unsigned for refernce counter (#2087652)
  - macro: check over flow in reference counter (#2087652)
  - sd-bus: fix reference counter to be incremented (#2087652)
  - sd-bus: introduce ref/unref function for track_item (#2087652)
  - sd-bus: do not read unused value (#2087652)
  - sd-bus: do not return negative errno when unknown name is specified (#2087652)
  - sd-bus: use hashmap_contains() and drop unnecessary cast (#2087652)
  - test: shorten code a bit (#2087652)
  - test: add several tests for track item (#2087652)
  - core/slice: make slice_freezer_action() return 0 if freezing state is unchanged (#2087652)
  - core/unit: fix use-after-free (#2087652)
  - core/timer: fix potential use-after-free (#2087652)
  - core: command argument can be longer than PATH_MAX (#2073994)
  - shared/install: consistently use 'lp' as the name for the LookupPaths instance (#2082131)
  - shared/specifier: treat NULL the same as "" (#2082131)
  - shared/install: do not print aliases longer than UNIT_NAME_MAX (#2082131)
  - shared/install-printf: drop now-unused install_path_printf() (#2082131)
  - strv: declare iterator of FOREACH_STRING() in the loop (#2082131)
  - basic/unit-file: split out the subroutine for symlink verification (#2082131)
  - basic/stat-util: add null_or_empty_path_with_root() (#2082131)
  - shared/install: reuse the standard symlink verification subroutine (#2082131)
  - shared/install: add a bit more quoting (#2082131)
  - test: add test for systemctl link & enable (#2082131)
  - tests: add helper for creating tempfiles with content (#2082131)
  - man: clarify the descriptions of aliases and linked unit files (#2082131)
  - basic: add new variable $SYSTEMD_OS_RELEASE to override location of os-release (#2082131)
  - test-os-util: add basic tests for os-release parsing (#2082131)
  - basic/env-file: make load-env-file deduplicate entries with the same key (#2082131)
  - man/os-release: add a note about repeating entries (#2082131)
  - shared/specifier: clarify and add test for missing data (#2082131)
  - shared/specifier: provide proper error messages when specifiers fail to read files (#2082131)
  - shared/install: provide proper error messages when invalid specifiers are used (#2082131)
  - shared/install: move scope into InstallContext (#2082131)
  - shared/specifier: fix %u/%U/%g/%G when called as unprivileged user (#2082131)
  - shared/install: simplify unit_file_dump_changes() (#2082131)
  - shared/install: propagate errors about invalid aliases and such too (#2082131)
  - shared/install: return failure when enablement fails, but process as much as possible (#2082131)
  - systemctl: fix silent failure when --root is not found (#2082131)
  - shared/install: also check for self-aliases during installation and ignore them (#2082131)
  - docs: Correct WantedBy= regarding template units (#2082131)
  - man: fix invalid description of template handling in WantedBy= (#2082131)
  - shared/install: drop unnecessary casts (#2082131)
  - strv: make iterator in STRV_FOREACH() declaread in the loop (#2082131)
  - core: ExecContext::restrict_filesystems is set of string (#2082131)
  - install: when linking a file, create the link first or abort (#2082131)
  - shared/install: split unit_file_{disable,enable}() so _reenable doesn't do setup twice (#2082131)
  - shared/install: fix reenable on linked unit files (#2082131)
  - test-systemctl-enable: extend the test for repeated WantedBy/RequiredBy (#2082131)
  - shared/install: when we fail to chase a symlink, show some logs (#2082131)
  - shared/install: do not try to resolve symlinks outside of root directory (#2082131)
  - test-systemctl-enable: enhance the test for unit file linking (#2082131)
  - shared/install: skip unnecessary chasing of symlinks in disable (#2082131)
  - shared/install: also remove symlinks like .wants/foo@one.service → ../foo@one.service (#2082131)
  - shared/install: create relative symlinks for enablement and aliasing (#2082131)
  - shared/install: when looking for symlinks in .wants/.requires, ignore symlink target (#2082131)
  - shared/install: stop passing duplicate root argument to install_name_printf() (#2082131)
  - basic/unit-file: reverse negative conditional (#2082131)
  - shared/install: split UNIT_FILE_SYMLINK into two states (#2082131)
  - shared/install: fix handling of a linked unit file (#2082131)
  - test-systemctl-enable: make shellcheck happy (#2082131)
  - shared/install: when creating symlinks, accept different but equivalent symlinks (#2082131)
  - test-systemctl-enable: use magic syntax to allow inverted tests (#2082131)
  - test-systemctl-enable: also use freshly-built systemd-id128 (#2082131)
  - test-systemctl-enable: disable the test for %a for now (#2082131)
  - Rename UnitFileScope to LookupScope (#2082131)
  - core: handle lookup paths being symlinks (#2082131)
  - shared/install: use correct cleanup function (#2082131)
  - udev/net_id: avoid slot based names only for single function devices (#2073003)
  - test: import logind test from debian/ubuntu test suite (#2087652)
  - test: drop redundant IMAGE_NAME= (#2087652)
  - test: import timedated test from debian/ubuntu test suite (#2087652)
  - test: introduce assert_not_in() helper function (#2087652)
  - test: drop unnecessary --no-pager option (#2087652)
  - test: support debian/ubuntu specific timezone config file (#2087652)
  - test: import hostnamed tests from debian/ubuntu test suite (#2087652)
  - locale-util: fix memleak on failure (#2087652)
  - locale-util: check if enumerated locales are valid (#2087652)
  - locale-util: align locale entries (#2087652)
  - core: inline an iterator variable (#2087652)
  - locale-setup: merge locale handling in PID1 and localed (#2087652)
  - locale: rename keymap-util.[ch] -> localed-util.[ch] (#2087652)
  - test: add one more path to search keymaps (#2087652)
  - test: introduce inst_recursive() helper function (#2087652)
  - hmac/sha256: move size define to sha256.h (#2087652)
  - tpm2: support policies with PIN (#2087652)
  - cryptenroll: add support for TPM2 pin (#2087652)
  - cryptsetup: add support for TPM2 pin (#2087652)
  - cryptsetup: add libcryptsetup TPM2 PIN support (#2087652)
  - cryptenroll: add TPM2 PIN documentation (#2087652)
  - cryptsetup: add manual TPM2 PIN configuration (#2087652)
  - cryptenroll: add tests for TPM2 unlocking (#2087652)
  - env-util: replace unsetenv_erase() by new getenv_steal_erase() helper (#2087652)
  - test: install libxkbcommon and x11 keymaps (#2087652)
  - test: install C.UTF-8 and English locales (#2087652)
  - test: import localed tests from debian/ubuntu test suite (#2087652)
  - unit: check for mount rate limiting before checking active state (#2087652)
  - tests: make sure we delay running mount start jobs when /p/s/mountinfo is rate limited (#2087652)
  - test: insert space in for loop (#2087652)
  - test: move "do" at the end of line (#2087652)
  - test: use trap RETURN (#2087652)
  - test: ignore the error about our own libraries missing during image creation (#2087652)
  - test: wrap binaries using systemd DSOs when running w/ ASan (#2087652)
  - test: set $ASAN_RT_PATH along with $LD_PRELOAD to the ASan runtime DSO (#2087652)
  - test: drop all LD_PRELOAD-related ASan workarounds (#2087652)
  - test: don't wrap binaries built with ASan (#2087652)
  - test: send stdout/stderr of testsuite units to journal & console (#2087652)
  - test: make the busy loop in TEST-02 less verbose (#2087652)
  - test: always wrap useradd/userdel when running w/ ASan (#2087652)
  - test: don't flush debug logs to the console (#2087652)
  - test: fix a couple of issues found by shellcheck (#2087652)
  - test: pass the initdir to check_result_{qemu,nspawn} hooks (#2087652)
  - test: run the custom check hooks before common checks (#2087652)
  - test: check journal directly instead of capturing console output (#2087652)
  - test: use saved process PID instead of % (#2087652)
  - test: account for ADDR_NO_RANDOMIZE if it's set (#2087652)
  - fuzz-bcd: silence warning about always-true comparison (#2087652)
  - test: disable test_ntp on RHEL (#2087652)
  - core: do not filter out systemd.unit= and run-level specifier from kernel command line (#2087652)
  - test: add a simple test for daemon-reexec (#2087652)
  - test: install /usr/libexec/vi as well (#2087652)
  - test: resize the terminal automagically with INTERACTIVE_DEBUG=yes (#2087652)
  - test: create an ASan wrapper for `getent` and `su` (#2087652)
  - test: mark partition bootable (#2087652)
  - test: bump the data partition size if we don't strip binaries (#2087652)
  - test: use PBKDF2 with capped iterations instead of Argon2 (#2087652)
  - locale: drop unnecessary allocation (#2087652)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-9
changelog:
  - Revert "shared/install: create relative symlinks for enablement and aliasing" (#2118668)
  - glyph-util: add new glyphs for up/down arrows (#2118297)
  - tree-wide: allow ASCII fallback for → in logs (#2118297)
  - tree-wide: allow ASCII fallback for … in logs (#2118297)
  - core: allow to set default timeout for devices (#2116681)
  - man: document DefaultDeviceTimeoutSec= (#2116681)
  - man: update dbus docs (#2116681)
  - hwdb: 60-keyboard: Fix volume-button mapping on Asus TF103C (#2087778)
  - hwdb: CH Pro Pedals not classified correctly due to no buttons (#2087778)
  - hwdb: Add accel orientation quirk for the GPD Pocket 3 (#2087778)
  - hostname: Allow overriding the chassis type from hwdb (#2087778)
  - hwdb: Add Microsoft Surface Pro 1 chassis quirk (#2087778)
  - hwdb: treat logitech craft keyboard as a keyboard (#2087778)
  - test: frequency in mouse DPI is optional (#2087778)
  - hwdb: add two Elecom trackballs (#2087778)
  - hwdb: add new database file for PDA devices (#2087778)
  - hwdb: add support for Surface Laptop 2 & 3 (#22303) (#2087778)
  - hwdb: add HP calculators (#2087778)
  - hwbd: 60-sensor.hwdb: Add Pipo W2Pro (#2087778)
  - hwdb: 60-keyboard: Support the buttons on CZC P10T tablet (#2087778)
  - hwdb: add CST Laser Trackball (#22583) (#2087778)
  - hwdb: Force release calculator key on all HP OMEN laptops (#2087778)
  - Add support for NEC VersaPro VG-S (#2087778)
  - Fix mic mute on Acer TravelMate B311-31 (#22677) (#2087778)
  - Add AV production controllers to hwdb and add uaccess (#2087778)
  - hwdb: Add AV production access to Elgado Stream Deck devices (#2087778)
  - Add HP Elitebook 2760p support (#22766) (#2087778)
  - hwdb: Add mic mute key mapping for HP Elite x360 (#2087778)
  - hwdb: fix parser to work with newer pyparsing (#2087778)
  - hwdb: update for v251 (#2087778)
  - hwdb: update autosuspend entries (#2087778)
  - hwdb: drop boilerplate about match patterns being unstable (#2087778)
  - hwdb: Update 60-keyboard.hwdb (#23074) (#2087778)
  - hwdb: 60-keyboard: Add Acer Aspire One AO532h keymappings (#2087778)
  - hwdb 60-keyboard Add HP/Compaq KBR0133 (#2087778)
  - hwdb: add resolutions for the Vaio FE14 touchpad (#23136) (#2087778)
  - hwdb: Remap micmute to f20 for ASUS WMI hotkeys (#2087778)
  - hwdb: Fix rotation for HP Pro Tablet 408 G1 (#2087778)
  - hwdb: add keyboard mapping for HP ProBook 11G2 (#2087778)
  - hwdb: make sure "ninja update-hwdb" works on f35 (#2087778)
  - hwbd: run "update-hwdb" for v251-rc2 (#2087778)
  - hwdb: run "ninja update-hwdb-autosuspend" for v251-rc2 (#2087778)
  - Fix orientation detection for Asus Transformer T100TAF, copied T100TA rule (#2087778)
  - Fix orientation detection for HP Pavilion X2 10-k010nr (#2087778)
  - fix typo (#2087778)
  - Adding a description of the keyboard shortcut Fn+F12 for the HP EliteBook 845 G7 device. (#23253) (#2087778)
  - hwdb: run "update-hwdb" (#2087778)
  - hwdb: add rammus accelerometer support (#2087778)
  - Add support to set autosuspend delay via hwdb (#2087778)
  - Set autosuspend delay for Fibocom LG850-GL (#2087778)
  - Add HUION Inspiroy H420X to hwdb (#2087778)
  - hwdb: run 'update-hwdb' for v251-rc3 (#2087778)
  - hwdb: add touchpad parameters for Lenovo T15g Gen1 (#23373) (#2087778)
  -  hwdb: Add accel orientation for the I15-TG (#2087778)
  - hwdb: fix accelerometer mount matrix for Aquarius NS483 (#2087778)
  - hwdb: Add Google Hangouts Meet speakermic (#2087778)
  - hwdb: update via ninja -C build update-hwdb (#2087778)
  - hwdb: Add Google Meet speakermic (#2087778)
  - hwdb: Add accel orientation quirk for the Aya Neo Next (#2087778)
  - hwdb: Add HP Dev One (#2087778)
  - hwdb: analyzers: remove generic "STM Device in DFU Mode" (#2087778)
  - hwdb: Add Lenovo ThinkPad C13 Yoga (#2087778)
  - Fix automatic screen rotation for Asus Transformer T100TAM (#2087778)
  - hwdb: Add Acer Aspire A317-33 (#24050) (#2087778)
  - Add ACCEL_MOUNT_MATRIX for OXP Mini (#2087778)
  - Added DERE DBook D10 (#24173) (#2087778)
  - hwdb: analyzers: Clarify the type of devices we want listed (#2087778)
  - hwdb: Add Greaseweazle "drives" to the list of analyzers (#2087778)
  - hwdb: Apply existing accel orientation quirk to all Chromebooks (#2087778)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-11
changelog:
  - scope: allow unprivileged delegation on scopes (#2120604)
  - udev/net_id: add "rhel-9.1" naming scheme (#2121144)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-12
changelog:
  - core/load-fragment: move config_parse_sec_fix_0 to src/shared (#2100464)
  - logind: add option to stop idle sessions after specified timeout (#2100464)
  - tree-wide: fix typo (#2100464)
  - test: several cleanups for TEST-35-LOGIN (#2100464)
  - test: start test user session before idle action setting is changed (#2100464)
  - test: ensure cleanup functions return success (#2100464)
  - test: add test for org.freedesktop.login1.Session SetType (#2100464)
  - test: add a simple test for list-users (#2100464)
  - test: merge grep | awk calls (#2100464)
  - test: wait for user service or slice to be finished (#2100464)
  - test: terminate session and user on cleanup (#2100464)
  - test: do not restart getty@tty2 automatically (#2100464)
  - tests: add test for StopIdleSessionSec= option (#2100464)
  - logind: schedule idle check full interval from now if we couldn't figure out atime timestamp (#2100464)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-12.2
changelog:
  - coredump: adjust whitespace (#2155516)
  - basic: add STRERROR() wrapper for strerror_r() (#2155516)
  - coredump: do not allow user to access coredumps with changed uid/gid/capabilities (#2155516)
  - Packit: build SRPMs in Copr (#2155516)
  - test: support non-summer time (#2155516)
  - test: bump the base VM memory to 768M (#2155516)
  - test: don't overwrite existing $QEMU_OPTIONS (#2155516)


author: systemd maintenance team <systemd-maint@redhat.com> - 250-12.3
changelog:
  - shared/json: allow json_variant_dump() to return an error (#2149074)
  - shared/json: use different return code for empty input (#2149074)
  - coredump: avoid deadlock when passing processed backtrace data (#2149074)
  - test: disable flaky subtests that require udevadm wait/lock (#2149074)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-61
changelog:
  - timer: rebase the next elapse timestamp only if timer didn't already run (RHEL-118215)
  - strv: introduce string_strv_hashmap_remove() (RHEL-14112)
  - unit-file: introduce unit_file_remove_from_name_map() (RHEL-14112)
  - core/unit: remove path to transient unit file from unit name maps on stop (RHEL-14112)
  - TEST-07-PID1: add reprudcer for issue #35190 (RHEL-14112)
  - coredump: handle ENOBUFS and EMSGSIZE the same way (RHEL-103801)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-62
changelog:
  - ukify: rstrip and escape binary null characters from 'inspect' output (#38607) (RHEL-109558)
  - timer: rebase last_trigger timestamp if needed (RHEL-118215)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-63
changelog:
  - cryptsetup-generator: refactor add_crypttab_devices() (RHEL-127859)
  - cryptsetup-generator: continue parsing after error (RHEL-127859)
  - cryptsetup-generator: parse all cmdline devices too (RHEL-127859)
  - cryptsetup-generator: always process cmdline devices (RHEL-127859)
  - logind: add "background-light" session class (RHEL-109833)
  - pam_systemd: honor session class provided via PAM environment (RHEL-109833)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-64
changelog:
  - core: fix array size in unit_log_resources() (RHEL-131338)
  - pid1: add env var to override default mount rate limit burst (RHEL-129153)
  - pid1: add env var to override default mount rate limit interval (RHEL-129153)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-65
changelog:
  - update specfile and sources after renaming rhel-net-naming-sysattrs to net-naming-sysattrs (RHEL-150622)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-66
changelog:
  - core/service: fix error cause in the log (RHEL-138414)
  - fstab-generator: drop assertions for mount opts (RHEL-92752)
  - fstab-generator: fix options in systemd.mount-extra= arg (RHEL-92752)
  - core: reorder systemd arguments on reexec (RHEL-111135)
  - basic: add RuntimeScope enum (RHEL-137252)
  - runtime-scope: add helper that turns RuntimeScope enum into --system/--user string (RHEL-137252)
  - sd-path: add support for XDG_STATE_HOME (RHEL-137252)
  - sd-path: bring spacing in sd-path.h and systemd-path tool in sync (RHEL-137252)
  - path tool: add some basic ansi highlighing (RHEL-137252)
  - execude: include RuntimeScope field in ExecParameters (RHEL-137252)
  - execute: remove redundant assignment (RHEL-137252)
  - execute: when recursively chowning StateDirectory= when spawning services, follow initial symlink (RHEL-137252)
  - execute: add support for XDG_STATE_HOME for placing service state data in --user mode (RHEL-137252)
  - execute: associate logs from setup_exec_directory() with the unit name (RHEL-137252)
  - execute: shorten some code by using RET_NERRNO() (RHEL-137252)
  - execute: shorten code by making use of laccess() return code properly (RHEL-137252)
  - execute: don't bother with chowning StateDirectory= and friends in user mode (RHEL-137252)
  - test: add test for new XDG_STATE_HOME handling (RHEL-137252)
  - man: mention the newly-added XDG_STATE_HOME (RHEL-137252)
  - man: rebreak lines in file-hierarchy(7) a bit (RHEL-137252)
  - man: properly close XML tags (RHEL-137252)
  - tmpfiles: teach tmpfiles the new XDG_STATE_HOME variable too (RHEL-137252)
  - test: use XDG_STATE_HOME for %S and %L (RHEL-137252)
  - man: fully adopt ~/.local/state/ (RHEL-137252)


author: systemd maintenance team <systemd-maint@redhat.com> - 252-67.3
changelog:
  - nspawn: apply BindUser/Ephemeral from settings file only if trusted (RHEL-163870)
  - nspawn: normalize pivot_root paths (RHEL-163870)
  - udev: check for invalid chars in various fields received from the kernel (RHEL-163876)
  - udev: fix review mixup (RHEL-163876)
  - udev/scsi-id: check for invalid chars in various fields received from the kernel (RHEL-163876)


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-65
changelog:
  - Update OpenSSL certificates set up
    Resolves: RHEL-81721
  - Remove deprecated path from systemd service file
    Resolves: RHEL-81716


author: Vitezslav Crhonek <vcrhonek@redhat.com> - 2:2.14.1-66
changelog:
  - Use systemd-sysusers for the 'pegasus' user and group creation
  - Fix Requires of subpackages
    Related: RHEL-90737
  - Add support for Image Mode
    Resolves: RHEL-90737


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.17.2-1
changelog:
  - preload: Wrap statx() and fstatat(), to fix `ls` and other tools on
    recent glibc versions. (#160)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.17.6-1
changelog:
  - Increase uevent buffer size (#167)
  - Skip /umockdev-testbed-vala/detects_running_outside_testbed during normal
    builds for the time being, as it is brittle on several architectures (#169)


author: Packit Service <user-cont-team+packit-service@redhat.com> - 0.17.8-1
changelog:
  - Fix some potential crashes spotted by Coverity
  - Enable Fedora builds and bodhi updates via packit


author: Packit <hello@packit.dev> - 0.17.10-1
changelog:
  - Adjust to systemd 251-rc2: Set $SYSTEMD_DEVICE_VERIFY_SYSFS, parse new udevadm format, update tests


author: Packit <hello@packit.dev> - 0.17.13-1
changelog:
  - preload: Wrap fstatfs(), to work with systemd 251 also with Python tests
  - Fix tests in Gentoo sandbox build


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-1
changelog:
  - Update to 4.3
  - Add GPG signature check for the source
  - Fix pycached stuff
  - Remove old python_provide macro
  - Remove ldconfig_scriptlets macro
  - Only use VFST for now, HFST can be provided in a later update


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-2
changelog:
  - Bump release for a new Copr build
  - Rebuilt for https://fedoraproject.org/wiki/Fedora_34_Mass_Rebuild


author: Ville-Pekka Vainio <vpvainio AT iki.fi> - 4.3-3
changelog:
  - The dictionary data directory will now be /usr/lib/voikko on all architectures
  - Create and own /usr/lib/voikko, so different dictionary packages can own the subdirectories there
  - This was suggested in the review of the voikko-fi package, see rhbz#1919688
  - Use the license macro


author: Brian C. Lane <bcl@redhat.com> - 35.12-1
changelog:
  - Copy rhel-9.4.json test repository from osbuild-composer
  - New release: 35.12 (bcl)
    Resolves: RHEL-1035
  - Add support for compose start warning messages (bcl)
  - Update documentation urls for new locations (bcl)
  - weldr: go fmt changes to a couple comments (bcl)
  - weldr: Update ostree test for parentid with no url (bcl)
  - Makefile: Turn off seccomp for build-in-podman (bcl)
  - composer-cli: Update doc links (simon.steinbeiss)
  - docs: fix typo/formatting in HACKING.md (idiez)
  - Add release creation documentation (bcl)
  - spec: Require createrepo_c for weldr-client-tests package (bcl)
  - spec: migrate the license field to SPDX (ondrej)
  - Go: Switch to go 1.19 (bcl)
  - CI: Update terraform hash (bcl)
  - Actions: add workflow for marking and closing stale issues and PRs (thozza)
  - workflows: Stop using golint (bcl)
  - workflows: Add Go 1.21 and 1.22 to test matrix (bcl)
  - workflows: Update to golangci-lint 1.56.2 (bcl)
  - workflow: Ignore govulncheck failures (bcl)
  - workflow: Switch to testing on go 1.18, 1.19, 1.20 (bcl)
  - build(deps): bump actions/setup-go from 3 to 5 (49699333+dependabot[bot])
  - build(deps): bump github.com/spf13/cobra from 1.6.1 to 1.8.0 (49699333+dependabot[bot])
  - build(deps): bump actions/checkout from 3 to 4 (49699333+dependabot[bot])
  - build(deps): bump github.com/BurntSushi/toml from 1.2.1 to 1.3.2 (49699333+dependabot[bot])
  - build(deps): bump github.com/stretchr/testify from 1.8.1 to 1.8.4 (49699333+dependabot[bot])


author: Brian C. Lane <bcl@redhat.com> - 35.12-3
changelog:
  - tests: OSTree does not support the qcow2 image type
  - Add test repositories for RHEL 9.6 and 9.7
  - Rebuild for CVE-2025-22871
    Resolves: RHEL-89344


author: Brian C. Lane <bcl@redhat.com> - 35.12-4
changelog:
  - Bump release for y-stream AND z-stream building using
    centpkg build --rhel-target=zstream
    Related: RHEL-89344


author: Michal Srb <michal@redhat.com> - 1.51.0-16
changelog:
  - Drop bundled expat and build against libxml2
  - Resolves: CVE-2022-25235
  - Resolves: CVE-2022-25236


author: Neal Gompa <ngompa13@gmail.com> - 1:7.5-49
changelog:
  - Add OrderWithRequires for freetype to ensure freetype is installed first
  - Move license files to license tag on file list


